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The  problem  analyzed  is  how  to  provide  most  efficiently  in 
a  weapon,  in  an  economic  sense,  high  reliability  -  defined 
as  the  probability  of  the  weapon  to  operate  properly  whenever, 
within  its  prescribed  service  life,  it  is  called  upon  to  do  so. 
The  problem  is  discussed  in  the  context  of  a  re-entry  body  (weapon) 
for  a  strategic  missile.   A  method  is  proposed  for  building  up  a 
supply  curve  of  initial  (when  new)  reliability,  using  a  generalized 
Lagrange  multiplier  method.   Selection  of  the  reliability  goal 
based  upon  the  value  of  the  product  is  discussed.   A  model  is  also 
developed  for  maintenance  of  reliability  in  the  presence  of  degrada- 
tion with  time.   The  nature  of  this  latter  question  is  the  acceptance 
of  degradation  of  weapon  output  versus  the  cost  of  maintenance 
activities.   Important  parameters  are  examined  in  a  cost  minimiza- 
tion formulation  using  a  standard  Lagrangean  format.   The  analysis 
is  extended  into  subjective  consideration  of  utility  of  reliability, 
and  risk  and  uncertainty.   How  the  analysis  could  be  used  to  assist 
a  weapon  development  agency  in  design  and  maintenance  decisions 
is  indicated. 
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I .   BACKGROUND 

A.   Nature  of  the  Problem 

The  problem  to  be  investigated  is  how  to  provide  most  efficiently, 
in  an  economic  sense,  a  high  probability  of  a  weapon  containing  a 
complex  functional  device  to  operate  properly  whenever,  within  its 
prescribed  service  life,  it  is  called  upon  to  do  so.   We  are  speaking 
of  explosive  weapons  which  are  only  called  upon  to  operate  once.   The 
time  at  which  a  weapon  is  used  may  be  when  almost  new  or  after  it  has 
undergone  a  long  period  of  storage.   "Long"  in  this  case  means  long 
enough  that  a  predicted  .  low  failure  rate  under  a  relatively  benign 
storage  condition  becomes  significant  in  reduction  of  reliability 
at  the  time  of  use. 

The  intent  of  this  thesis  is  to  explore  how  the  standard  tools 
of  economic  analysis  may  be  applied  to  assist  in  a  decision  process 
concerning  provision  of  reliability  which  cannot  properly  be  the 
domain  of  reliability  and  systems  engineering  specialists  alone. 
Some  of  the  important  questions  to  be  decided  in  arriving  at  a  weapon 
system  of  given  effectiveness  at  least  cost  are: 


Thus,  already  we  see  that  the  reliability  definition  above  is 
open  to  ambiguous  interpretation,  dependent  on  what  has  been  the  past 
history  of  the  weapon  at  the  time  of  use.   Contractors  usually  like 
to  be  held  to  only  meeting  what  is  called  an  initial  (when  new)  or 
inherent  reliability.   Inherent  has  the  broader  connotation  of  meaning 
what  the  design  would  be  capable  of  producing  if  everything  in  the 
production  process  were  done  perfectly.   But  then  this  reliability  is 
stated  to  pertain  initially,  and  the  prediction  of  degradation  before 
use  (while  it  is  in  the  hands  of  the  using  service,  albeit  under  known 
specified  procedures  and  environmental  conditions)  is  a  complex  question 
the  answer  to  which  the  contractor  would  not  like  his  fee  to  depend 
upon. 
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(1)  Should  the  design  and  support  concept  be  that  of  a  "wooden 
bomb"?  By  wooden  bomb  is  meant  a  weapon  for  which  neither  test  not 
maintenance  is  necessary  after  its  introduction  into  the  operational 
inventory  of  a  military  service.   Under  this  concept,  to  meet  a 
reliability  goal  applicable  after  a  long  service  life  and  given  that 
reliability  does  degrade  with  time,  one  must  pay  the  extra  cost  of 
development  of  a  system  with  higher  reliability  when  equipment  is  new. 
But  there  are  obvious  counterbalancing  savings  from  the  absence  of 
test  and  maintenance  expenses. 

(2)  If  periodic  tests  are  to  be  conducted,  what  are  the  nature 
and  frequency  of  the  tests?  The  trade-off  here  is  between  the  cost 
of  obtaining  information  and  the  value  of  the  information  obtained. 
Decision  rules  are  needed  concerning  action  upon  completion  of  test  - 
continue  in  use,  repair,  or  replace. 

(3)  If  the  intended  support  concept  is  to  treat  the  weapon  like 
a  wooden  bomb,  should  allowance  be  made  in  the  design  for  a  change  in 
the  planned  logistics  sequence  should  the  expectation  of  conditions 
upon  which  the  decision  was  based  be  proved  wrong  in  such  a  way  as 

to  impose  a  severe  penalty  for  not  having  a  test  and  maintenance 
activity?   The  question  here  is  analogous  to  whether  or  not  to  pay 
an  insurance  premium  for  possible  failures  during  the  service  life  - 
failures  whose  probability  may  be  known  much  less  exactly  than  events 
based  on  insurance  actuarial  tables. 

(4)  What  should  be  the  reliability  goal  of  the  weapon,  considering 
the  possibility  of  a  repair/replace  cycle  or  not?   Although  the  problem 
in  reliability  engineering,  particularly  from  the  standpoint  of  the 
reliability  when  new,  has  been  extensively  treated  by  sophisticated 


optimization  techniques  trading  off  attainment  of  high  reliability 
versus  performance  degradation  and  the  costs  of  producing  high 
reliability  equipment  with  attendant  comprehensive  test  programs;  the 
solutions,  especially  in  weapons  for  expensive  strategic  missile 
systems,  have  been  rather  trivial  and  arbitrary  from  an  economic 
point  of  view.   The  worth  of  the  weapon  and  supporting  missile  system 
has  been  so  high  that  the  reliability  goal  for  the  functional  device 
in  the  weapon  has  been  set  very  high,  near  the  level  of  estimated 
feasibility  with  little  regard  for  cost.   But  costs  are  expended  in 
an  attempt  to  meet  the  reliability  specification,  and  in  that  way  of 
doing  business  there  is  not  likely  to  be  an  attempt  made  to  see  that 
marginal  cost  is  equated  to  marginal  revenue.   A  trend  toward  multiple 
weapons  on  each  missile  should  enhance  the  importance  of  the  economic 
costs  of  attaining  reliability  relative  to  weapon  worth  since  the  total 
value  of  the  system,  although  it  may  be  somewhat  larger,  is  spread  over 
many  more  weapons,  reducing  the  value  per  weapon. 

(5)   Should  the  available  design  alternatives  for  the  functional 
device,  based  on  acceptably  proved  technology,  be  deemed  unsatisfactory, 
suggesting  that  a  different  type  of  device  be  developed  for  the  weapon? 
Technological  considerations  may  have  dictated  use  of  an  electronic 
device  of  considerable  series  complexity.   Rather  than  expend  effort  in 
raising  the  reliability  of  this  design,  a  better  alternate  solution 
might  be  to  invest  in  a  research  and  development  program  for  a  device 
utilizing  a  different  technical  approach  with  a  potential  for  higher 
reliability  at  the  same  or  lower  cost  to  do  the  same  job. 


B.   Failure  Rate  Prediction 
Reliability  of  a  device  is  usually  conceptually  considered 
in  two  different  ways,  dependent  on  whether  the  device  must  operate 
over  a  long  period  of  time  or  is  a  one-time  use  piece  of  equipment. 
For  an  explosive  mechanism  usually  the  latter  applies  and  a  prediction 
of  reliability  would  be  based  on  the  result  of  many  trials  of  hopefully 
identical  mechanisms,  with  reliability  estimated  by  the  number  of 
successes  divided  by  the  total  number  of  trials.   For  prediction  of 
reliability  for  devices  which  must  operate  for  a  finite  length  of 
time  in  order  to  meet  the  definition  of  mission  success,  the  reliability 
may  be  predicted  prior  to  experimental  testing  of  the  device  if  one 
has  a  basis  for  predicting  the  probability  distribution  of  failures 
over  time.   An  estimation  of  failure  rate  expressed  mathematically 
leads  to  a  calculation  of  reliability  based  upon  the  estimate. 
Prediction  of  the  failure  rate  of  a  complex  functional  device  is  based 
upon  what  is  known  or  assumed  about  the  failure  rates  of  the  parts 
making  up  the  device  and  how  these  parts  are  assembled  together. 
Electronic  devices  will  be  used  for  illustration  in  this  thesis  both 
because  of  their  practical  importance  and  their  amenability  to  mathe- 
matical modeling  and  prediction  of  failure  rates.   However,  it  should 
be  remembered  that  the  economic  theory  does  not  depend  on  the  physical 
nature  of  the  device.   It  will  also  be  evident  that  the  decisions  of 
major  economic  importance  are  not  dependent  on  very  accurate  predictions 
of  failure  rate. 

This  thesis  does  not  dwell  on  the  engineering  aspects  of  the 
problem  although  they  are  of  prime  importance  in  any  practical 
application.   Reliability  prediction  procedures  for  electronic  equipment 


have  been  extensively  investigated.   Reference  1    is  cited  for 
a  comprehensive  treatment  of  electronic  design  and  reliability 
engineering;  reference   2  for  reliability  engineering  as  related  to 
maintainability  and  system  effectiveness.   Data  on  failure  rates 
of  electronic  parts  for  predictions  of  equipment  reliability  on  military 
contracts  are  compiled  in  reference   3   .   A  consistent  set  of  terms 
and  symbols  will  be  used  in  this  thesis,  not  necessarily  consistent 
with  that  used  in  any  of  the  references  cited. 

The  reliability  of  an  electronic  device  is  inversely  proportional 
to  series  complexity,  but  considerable  complexity  may  be  necessary  to 
obtain  desired  performance  characteristics.   Given  the  design  concept, 
a  prediction  can  then  be  made  of  a  reliability  which  might  be  attained 
when  the  equipment  is  new.   Usually  in  the  past  a  prediction  of  failure 
rate  during  dormant  storage  has  been  considered  too  difficult  to  be 
done  or  deemed  not  significant.   However,  a  recent  report  of  a  study 
based  on  extensive  data  gathering  sheds  more  light  on  storage  effects 
on  electronic  equipment  and  part  reliability,  indicating  the  feasibility 
of  meaningful  quantitative  prediction  4   .   If  this  proves  to  be  valid 
and  the  dormant  failure  rates  are  significant,  it  is  important  that 
weapon  system  planning  take  them  into  account. 

Assuming  a  Poisson  distribution  of  failures  over  time,  the 
reliability  of  a  series  system  of  electronic  parts  is  expressed  by 
an  exponential  model: 

R  =  e 

Numbers  in     will  refer  to  the  list  of  literature  cited  at 
the  end  of  the  thesis. 


where 

R  =  reliability  of  the  system 

e   =  base  of  natural  logarithm 

X    =  constant  failure  or  hazard  rate  under  a  specified  set  of 
conditions 

t  =  time  under  the  specified  conditions. 

For  a  weapon  we  will  consider  a  factory-to-target  sequence  (FTS) 
with  time  phases  which  have  different  associated  failure  rates, 
dependent  on  the  associated  environmental  or  use  conditions,  and 
whether  the  equipment  is  operating  or  non-operating.   Thus,  for  each 
time  period  of  index  i,  we  have 


X  .  =  k.u . 

i    11 


where 


u .   =  basic  failure  rate  under  environmental  conditions  defined 
as  standard 

k.   =  the  failure  rate  adjustment  or  stress  factor  for  a  given 
use  condition 


Then, 

-yx.t. 

R  =  e 

consistent  with  a  failure  rate  addition  rule  of  independent  events. 
In  this  paper  we  will  call  the  product  for  any  period  the  hazard 
product,  defined  as 

h.  =  X .t.  . 

i    11 

Predicting  the  failure  rate  of  a  new  configuration  has  been  called 
"a  vague  and  imprecise  process  at  best"   5   .   But  the  author  of  the 
remark  shows  the  value  in  estimating  the  uncertainty  involved,  and 
it  follows  that  a  meaningful  estimate  is  better  than  no  estimate  at  all 


C.   Measure  of  Effectiveness 

To  do  an  economic  analysis  of  a  weapon  system  we  must  decide 
on  a  measure  of  effectiveness  (MOE) ,  the  output  of  the  weapon's 
production  function.   System  effectiveness  of  a  weapon  system  is 
generally  considered  to  be  a  product  of  the  following  three  items: 

(1)  Reliability 

(2)  Performance  characteristics,  given  no  failure 

(3)  Availability  or  proportion  of  time  ready  for  use. 

To  consider  whether  we  are  using  the  proper  MOE  in  our  analysis 
we  have  to  talk  about  suboptimization  and  proximate  criteria.   These 
are  discussed  in  Chapter  2  of  reference   6   in  relation  to  the 
manufacturing  industry.   The  same  principles  apply  to  our  production 
of  reliability  in  a  weapon.   It  is  brought  out  that  a  manufacturing 
department  for  practical  reasons  may  have  to  optimize  at  its  own 
level  although  ideally  the  problems  should  be  solved  according  to  the 
purpose  of  the  over-all  organization.   The  criterion  a  department 
uses  which  is  not  explicitly  linked  to  over-all  objectives  is  labeled 
a  proximate  criterion.   The  proximate  criterion  should  be  consistent 
with  a  good  criterion  at  a  higher  level.   It  is  clear  then  that 
reliability  of  a  weapon  is  only  a  proximate  criterion.   In  fact, 
effectiveness  of  the  weapon  based  on  the  three  items  above  is  not 
an  overall  criterion  if  the  weapon  is  only  a  part  of  the  weapon 
system.   We  must  be  careful  when  using  a  proximate  criterion  such 
as  reliability  of  a  weapon  to  take  account  of  the  interaction  of  our 
activities  to  increase  reliability  on  the  other  elements  of  the  MOE. 

In  this  thesis  which  will  primarily  for  illustrative  purposes 
consider  the  reliability  of  weapons  in  the  context  of  a  strategic 
missile  system,  the  use  of  the  effectiveness  of  the  weapon  deployed 


by  the  missile  as  a  proximate  criterion  for  the  effectiveness  of 
the  entire  missile  system  seems  reasonable  in  making  decisions  concerning 
design  of  the  carried  weapon.   The  weapon  containing  a  complex  functional 
device  for  causing  its  detonation  at  the  proper  time  in  the  trajectory 
will  be  called  the  re-entry  body  (REB) .   Since  the  rest  of  the  missile 
system  will  in  general  involve  more  complex  functions  than  the  REB 
(for  example^  propulsion  and  guidance),  we  can  in  looking  at  sub- 
optimization  of  the  effectiveness  of  the  REB  disregard  explicit  use 
of  the  availability  term.   That  is,  availability  of  the'  REB  will  be 
maintained  at  100%  of  missile  carrying  capability,  utilizing  scheduled 
down  time  of  the  missile  to  accomplish  any  planned  maintenance  of 
the  REB.   (This  does  not  say  we  should  not  worry  about  non-availability 
of  REBTs  which  might  result  from  unexpected  deficiencies  in  design 
which  are  subsequently  brought  to  light  by  some  testing  program.) 
The  extra  REB's  necessary  to  allow  a  planned  level  of  maintenance  which 
might  reduce  their  availability  in  the  ordinary  sense  of  the  word 
would  appear  in  increased  costs  of  procurement  -  not  in  reduction 
of  effectiveness. 

The  above  treatment  of  availability  might  seem  to  be  untrue  for 
tactical  weapons  as  opposed  to  strategic  ones,  but  in  some  cases 
it  would  be  quite  similar.   Although  in  theory  resupply  of  weapons 
can  take  place,  a  given  battle  is  usually  fought  with  what  is  on 
hand.   For  example,  if  we  consider  a  shipboard  surface-to-air  missile 
(SAM)  for  fleet  air  defense,  only  a  given  number  can  be  available 
on  board  for  any  engagement.   Effectiveness  during  any  battle  is 
only  reduced  by  the  availability  term  if  the  maintenance  concept 
calls  for  testing  the  functional  devices  on  board  for  a  decision  as 


to  their  condition,  with  or  without  provision  for  repair  on  board  if 
condition  is  deemed  bad.   If  the  concept  calls  for  issuance  to  the 
fleet  of  a  "wooden  round"  (completely  assembled  SAM  with  no  further 
tests  called  for) ,  availability  on  board  will  be  100%  with  effectiveness 
reduced  only  if  this  concept  results  in  lowered  reliability. 

The  REB  influences  on  performance  to  be  considered  are  those 
which  affect  explosive  yield  of  the  contained  warhead  and  accuracy  on 
target.   Anything  which  increases  weight  and  volume  of  the  functional 
device  detracts  from  yield,  due  to  robbing  space  and  weight  allocation 
for  the  warhead.   It  also  detracts  from  accuracy  because  it  restricts 
design  options  for  the  REB. 

D.   Analogy  with  Economic  Theory 

Since  the  stated  intent  is  to  apply  standard  tools  of  economic 
analysis  to  the  problem,  the  analogy  between  a  supply  of  reliability 
and  a  more  usual  economic  good  will  be  pointed  out  here. 

In  building  up  a  supply  curve  of  reliability  from  cost  curves 
we  can  relate  to  the  classic  article  by  Viner   7  which  treated 
the  supply  curve  of  firms  as  dependent  upon  different  types  of 
technological  and  pecuniary  cost  situations  under  the  assumption  of 
atomistic  competition.   His  stated  purpose  of  presenting  formal  types 
of  relationships  which  could  be  conceived  to  exist  under  certain 
simplifying  assumptions  to  help  answer  the  question  -  Which  cost 
curve  is  the  proper  supply  curve?  -  is  a  valid  objective  here.   Where 
Viner  speaks  of  a  firm  within  an  industry  producing  a  product, 
will  consider  the  processes  or  activities  within  the  entire  set  of 
productive  services  which  combine  to  supply  units  of  weapon  reliability 
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(looked  upon  as  an  increase  of  weapon  reliability,  AR,  above  some 
basic  level  because  reliability  must  refer  to  some  specific  design) . 
Where  Viner  speaks  of  price  of  product,  we  will  use  the  value  of 
unit  AR.   The  items  of  interest  will  be  the  increasing  portions  of 
the  average  and  marginal  cost  curves  and  how  they  relate  to  price 
of  product.   The  practical  nature  of  the  pecuniary  and  technological 
cost  situations  of  improving  reliability  puts  one  immediately  into  an 
area  of  increasing  average  costs,  which  is  probably  implicitly  recognized 
by  the  development  agencies.   But  do  they  consider  the  much  higher 
marginal  cost  which  should  be  examined  for  intersection  with  the 
price  level  to  determine  the  quantity  of  AR  produced? 

The  average  and  marginal  costs  are  of  course  derived  from  the 
total  cost  function.   The  factors  which  lie  behind  the  total  cost 
function  in  the  theory  of  the  firm  in  relation  to  production  decisions 
and  the  utilization  of  resources  are  discussed  in  Chapter  7  of 
reference   8   .   Starting  with:   (1)  a  production  function  which 
relates  outputs  to  inputs,  (2)  prices  of  product  and  inputs,  and 
(3)  the  assumption  that  profit  is  to  be  maximized  subject  to  the 
constraint  of  the  production  function;  nine  theorems  are  derived  which 
correspond  to  the  rules  of  standard  marginal  economic  analysis.   In 
our  case  the  single  output  is  AR  of  the  weapon.   The  inputs  are 
the  various  activities  for  which  the  cost  of  each  will  be  translated 
into  monetary  terms.   In  this  format  the  only  resource  to  be  allocated 
is  money.   For  optimal  decisions  one  of  the  theorems  proved  is  that 
the  marginal  product  per  dollar  cost  is  equal  for  every  input.   That 
is,  the  marginal  AR  per  dollar  cost  of  each  reliability  improvement 
process  should  be  equal.   Another  theorem  proved  states  that  any 
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output  will  be  produced  such  that  its  selling  price  equals  marginal  cost. 
This  corresponds  to  the  price  (value)  of  unit  AR  determining  the  level 
of  AR  so  that  marginal  cost  of  AR  does  equal  price.   Similar  analogy  can 
be  made  with  the  other  theorems. 

Two  concepts  from  price  theory,  both  discussed  in  Chapter  7  of 
reference   9   should  be  introduced  -  opportunity  costs  and  external  dis- 
economies.  Opportunity  cost  for  producing  a  given  amount  of  product  is 
the  amount  of  another  product  which  could  have  been  produced  with  the 
given  marginal  amount  of  input.   We  will  use  the  term  to  indicate  the 
amount  of  another  performance  aspect  which  would  have  been  obtained  if  we 
had  not  spent  a  given  amount  on  AR.   Viewed  another  way,  consideration  of 
the  costs  involving  the  overall  MOE  versus  the  costs  when  considering 
teliability  alone  corresponds  to  a  social  cost  versus  an  individual 
industry  cost.   We  can  put  these  costs  in  monetary  terms  if  we  can  place 
a  value  on  the  various  performance  aspects.   Secondly,  external  diseconomies 
may  result  from  expansion  of  output  overall.   In  production  theory  a 
monetary  diseconomy  pertains  if  the  price  of  inputs  rise  or  a  technological 
diseconomy  pertains  if  average  costs  rise  for  other  reasons.   In  our  case 
the  primary  reason  for  an  individual  reliability  effort  to  be  more 
expensive  as  the  aggregate  effort  rises  is  the  limited  amount  of  AR  possible 
Even  if  not  directly  conflicting  in  their  attainment  of  objectives,  the 
impact  of  the  activities  accentuates  the  importance  of  diminishing  returns 
as  reliability  to  be  gained  approaches  zero. 

In  the  reliability  improvement  problem  direct  analogy  with  opportunity 
costs  and  external  diseconomies  of  standard  production  theory  is  somewhat 
strained.   The  two  concepts  might  more  properly  be  lumped  together  and 
called  "external  effects";  that  is,  activities  to  improve     '  bility 
have  effects  on  other  items  of  the  ultimate  MOE  in  addition  to  th 
effects  on  each  other.   It  is  even  conceivable  that  these  effects  could 
be  so  large  in  a  negative  direction  that  the  relation  between 
and  weapon  system  effectiveness  would  not  be  a  monotonically  inc i 
function.   In  this  thesis  the  costs  from  these  external  effects  will  be 
called  opportunity  cost:  .  but  it  should  be  noted  that  there  is  not  an 
exact  parallel  to  the  opportunity  costs  of  standard  economic  analysis. 
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The  processes  or  activities  of  the  development  agency  to  improve 
weapon  reliability,  which  relate  to  the  productive  services  of  a  firm, 
will  be  categorized  as  follows: 

(1)  Functional  Design 

(a)  Reduction  of  complexity 

(b)  Redundancy 

(c)  Improvement  of  insensitivity  to  parameter  changes 

(d)  Provisions  for  test  in  field 

(2)  Packaging 

(a)  Provisions  for  integrated  test  in  manufacture 

(b)  Accessibility  for  test  and  repair/replace  in  field 

(c)  Environmental  stress  protection 

(3)  Manufacturing  and  Quality  Control 

(a)  Use  of  high  reliability  parts 

(b)  Process  control  and  testing  of  weapon 

(4)  Operational  Procedures 

(a)  Test  and  repair/replace  cycle 

(b)  Mitigation  of  stress  factors 

These  activities  are  chosen  to  relate  primarily  to  the  expected  reliability 
of  the  weapon  rather  than  to  the  confidence  with  which  that  reliability 
is  predicted  although  the  two  aspects  are  intimately  related.   For 
instance,  the  activities  under  item  (3)  above  involve  quantities  of 
tests,  many  of  which  will  be  determined  by  statistical  confidence  limits 
based  on  some  assumption  of  probability  distribution  of  attributes. 
But  the  primary  purpose  of  the  activity  is  to  increase  expected 
reliability  in  the  ultimate  use.   We  have  not  included  operational 
tests  (OT)  as  a  category  -  the  OT  being  a  near  as  full-scale  test 
as  possible  under  as  near  actual  use  conditions  as  possible  -  the  real 
purpose  not  being  to  improve  reliability  of  the  weapon  but  to  increase 
confidence  that  the  assumptions  which  led  to  the  predicted  reliability 
were  correct.   That  is,  the  OT  does  not  just  increase  statistical 
confidence  in  the  ordinary  sense  although  every  sample  contributes, 
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but  it  gives  qualitative  confidence  that  the  lower  level  test  programs 
were  testing  piece-meal  the  proper  attributes  to  insure  over-all 
success  in  an  operational  mission.   (The  Operational  Procedures  test 
category,  4a  above,  refers  to  a  test  or  monitoring  operation  on  the 
functional  device  in  the  field  with  the  explicit  intent  of  discovering 
and  correcting  bad  devices  before  use.)   Nor  have  we  included  a  stock- 
pile sampling  program  (SSP)  which  would  make  thorough,  intensive 
investigations  (usually  destructive  tests)  of  small  samples  from  the 
operational  inventory.   The  SSP  also  makes  a  small  contribution  to 
the  statistical  confidence  of  reliability,  but  it  primarily  would 
forewarn  of  an  impending  degradation  of  reliability.   As  such  an  SSP 
has  no  effect  on  reliability  unless  further  action  is  taken  based  upon 
the  information  provided. 

Now,  having  indicated  that  we  will  consider  the  activities 
primarily  in  terms  of  expected  reliabilities,  we  will  find  it  necessary 
to  extend  the  analysis  into  a  more  subjective  area  in  order  to  make 
final  common  sense  decisions.   The  two  major  categories,  both  widely 
used  in  economic  theory,  are: 

(1)  Risk,  Uncertainty  and  Profit 

(2)  The  Utility  Analysis  of  Choices  Involving  Risk. 

The  first  category  is  the  title  of  the  1921  book  by  Knight  analyzing 
profit  theory  from  largely  a  macroeconomic  point  of  view,  but  Chapter 
7  of  which  is  pertinent  here  in  its  discussion  of  the  meaning  of 
risk  and  uncertainty  10   .   The  second  is  the  title  of  a  1948  article 
by  Friedman  and  Savage  which  describes  utility  functions  of  individuals 
for  the  purpose  of  explaining  behavior  under  the  postulate  of  maximi- 
zation of  expected  utility  11   .   The  pertinent  portion  therein  is 
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the  shape  of  the  utility  function  of  one  who  will  pay  a  premium  to 
avoid  a  large  loss.   We  will  turn  the  argument  around;  rather  than 
explaining  behavior,  we  will  indicate  what  the  rational  behavior  of 
the  development  agency  should  be  (design  decision  alternatives)  based 
upon  an  assumption  of  at  least  the  gross  shape  of  the  ultimate  user's 
utility  function  for  the  product.   The  above  two  references  and  many 
others  are  cited  in  the  1965  study  by  Fellner  of  economic  behavior 
along  Bayesian  lines   12 j  .   We  will  use  only  a  few  of  the  ideas  from 
this  large  field  of  decision  making  under  uncertainty  in  an  attempt 
to  have  our  profit  maximization  make  sense  in  accordance  with  utility 
theory  and  in  the  presence  of  subjective  probability. 

Next  let  us  define  terms  for  use  in  this  thesis  (which  as  in 
reliability  theory  cannot  be  consistent  with  all  the  references)  and 
indicate  the  relation  to  the  particular  subject.   Risk  applies  where 
the  probability  of  an  event  can  be  calculated  in  terms  of  a  standard 
process  (heads  or  tails  type)  even  though  the  values  assigned  to  the 
standard  process  may  be  somewhat  subjective.   Basically,  risk  is 
calculated  by  frequentist  methods  -  observing  an  event  many  times 
and  relating  probability  to  observed  frequency.   It  seems  logical 
then  to  put  failure  rate  prediction  for  electronic  devices  into  the 
risk  category.   Even  though  the  particular  device  has  not  yet  even 
been  built,  the  reliability  calculations  are  based  on  piece  part 
experience  with  failure  rates  derived  by  frequency  methods.   Uncertainty, 
on  the  other  hand,  applies  where  a  method  of  calculation  of  probability 
of  an  event  is  less  clear  -  sometimes  said  to  be  a  case  of  no  theory 
for  calculation.   But  the  subjectivist  approach  allows  for  appraisal 
of  probability  values  and  using  them  to  inject  judgment  of  this  nature 
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in  the  decision  process.   We  will  use  uncertainty  to  apply  to  the 
appraisal  of  failure  modes  which  would  result  in  reliability  values 
beyond  the  scope  of  which  the  mathematical  models  will  predict.   For 
example,  developers  of  complex  functional  devices  for  weapons  where 
the  specification  for  reliability  is  well  above  90%  will  never  show 
a  mathematical  model  for  a  meaningful  prediction  of  the  probability 
of  achieving  only  20%.   But  we  know  that  such  things, verging  on 
catastrophic  in  terms  of  mission  success  for  the  weapon  system,  have 
happened;  and  people  with  experience  can  be  expected  to  make  meaningful 
appraisals  of  the  likelihood  of  such  happenings.   If  one  recognizes 
the  appraisal  of  the  probability  of  unpredicted  failure  modes,  the 
result  may  be  a  decision  to  select  alternatives  which  entail  real 
and  opportunity  costs  (buying  insurance)  to  make  it  less  costly  to 
correct  unsuspected  defects  should  they  occur. 

Essentially  then  we  can  list  three  levels  of  refinement  in 
maximizing  the  profit  from  reliability  provision  activities: 

(1)  Maximize  value  of  expected  reliability  minus  the  cost  of 
providing  it  where  we  assume  constant  value  of  units  of  reliability. 

(2)  Maximize  the  expected  utility  (ex  ante  profit)  of  the 
reliability  provision  where  ex  ante  profit  is  theoretically  defined 
as  follows : 

Let 

G  =  marginal  utility  of  potential  gain 

L  =  marginal  disutility  of  potential  loss 

X  =  units  of  reliability  provided 
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Then 

ex  ante  profit  =  /  (G  -  L)  dX 
where  the  potential  gains  and  losses  are  calculated  using  the  risk 
probabilities.   This  calculation  will  not  be  done  because  the  utility 
function  is  not  known  but  qualitative  judgments  can  be  made  from 
postulation  of  its  general  shape. 

(3)   Extend  the  above  analysis  to  allow  use  of  subjective 
probabilities . 


II.   PROVISION  OF  INITIAL  RELIABILITY 

A.   Subsystem  Reliability  Allocation 

To  begin  taking  one  step  at  a  time  in  attacking  a  very  complex 
problem  let  us  first  consider  how  we  might  arrive  at  a  reliability 
goal  for  the  REB,  one  subsystem  of  the  missile,  abstracting  from  any 
consideration  of  degradation  with  age.   That  is,  we  consider  failure 
rate  as  zero  during  any  period  of  the  FTS  except  time  in  missile  flight. 
This  facet  of  the  problem  will  be  considered  in  Chapter  III. 

For  a  weapon  system  made  up  of  several  subsystems  the  general 
problem  is  that  of  allocating  reliabilities  to  the  subsystems  so  that 
overall  reliability  is  attained  at  minimum  cost.   In  terms  of  production 
theory  the  output,  system  reliability,  is  a  function  of  the  inputs, 
the  reliabilities  of  the  various  subsystems, with  each  of  the  latter  having 
a  given  cost  function.   The  problem  is  very  non-linear  and  complex. 
The  design  options  are  not  only  non-linear  with  cost  but  are  usually 
non -continuous  functions.   The  various  alternatives  involve  quantum 
jumps.   There  are  also  interdependencies  among  the  subsystems  in  the 
production  function.   Also,  the  costs  to  be  properly  taken  into 
account  are  not  pecuniary  costs  alone  but  opportunity  costs  as  defined 
in  Section  ID  because  the  design  options  will  often  affect  other 
parameters   than  reliability  in  the  systems  effectiveness  relationship. 
This  is  another  way  of  saying  reliability  is  not  the  ultimate  MOE. 
However,  these  complexities  notwithstanding,  the  allocation  could  in 
principle  be  solved  for  an  optimal  decision  of  obtaining  given  system 
reliability  at  least  cost.   In  the  solution  set  of  all  subsystem 
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reliabilities  we  would  expect  the  marginal  product  per  dollar  to  be 
equal  for  every  input  -  that  is,  the  marginal  unit  of  reliability  to 
cost  the  same  in  every  subsystem. 

In  practice  the  reliability  goals  may  not  be  set  in  this  manner 
and  possibly  with  good  reason,  considering  all  the  uncertainties  in 
any  calculation.   However,  conducting  the  cost  estimating  exercise 
may  give  some  valuable  insights  into  parameter  sensitivities  and  be 
of  great  assistance  in  making  good  judgments  on  alternatives,  even 
though  little  faith  is  put  in  exact  attainment  of  the  calculated 
values.   There  may  also  be  good  reason  to  make  decisions  about  the 
re-entry  subsystem  design  independently  of  the  other  subsystems  - 
except  for  using  the  cost  of  the  over-aU  missile  system  as  a  measure 
for  pricing  the  product,  the  reliability  provided  within  the  REB 
subsystem.   On  technical  grounds  the  REB  is  from  a  functional  view- 
point relatively  independent  of  the  rest  of  the  missile  functions. 
Most  of  the  fallibility  occurs  in  a  device  which  operates  during 
time  when  the  REB  has  been  separated  from  the  missile.   Also,  techno- 
logical advances  or  reaction  to  enemy  defenses  may  dictate  putting 
new  re-entry  systems  on  the  same  missile.   Lastly,  there  are 
institutional  impediments  to  close  engineering  optimization  in  the 
development  of  the  re-entry  body  with  the  rest  of  the  missile  because 
the  warhead  portion  of  the  REB  is  provided  by  the  Atomic  Energy 
Commission,  a  co-partner  with  the  Department  of  Defense  in  REB  design 
changes.   Negotiating  interface  changes  with  an  autonomous  partner 
can  be  a  lengthy  process.   This  impediment  may  seem  unreasonable 
but  it  is  real. 

Due  to  the  high  cost  of  a  strategic  missile  system  for  delivery 
of  the  weapons,  it  soon  becomes  apparent  that  the  reliability  provided 
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in  the  REB  should  be  relatively  high,  well  into  the  area  of  decreasing 
marginal  returns  of  reliability  gained  from  improvement  activities. 
There  is  then  a  temptation  to  merely  estimate  what  might  be  technically 
feasible  without  regard  to  cost  and  set  this  as  the  reliability  goal. 
This  could  be  the  proper  goal,  but  it  might  be  too  high.   It  might  be 
cheaper  to  buy  more  missiles  rather  than  trying  to  push  REB  reliability 
into  a  very  high  marginal  cost  region. 

Consider  the  MOE  for  the  next  higher  level  criterion  to  be  the 
capability  of  inflicting  damage  on  a  given  target  complex.   The  number 
of  REB's  required  is  a  decreasing  function  of  their  reliability  while 
the  cost  of  the  REB's  is  an  increasing  function  of  their  reliability. 
For  reasons  cited  above  the  over-all  problem  of  minimizing  the  total 
cost  of  a  system  to  do  a  given  amount  of  damage  will  not  be  worked 
directly  including  the  REB  as  one  of  the  subsystems,  but  the  marginal 
cost  curve  of  units  of  REB  reliability  will  be  generated  from  various 
reliability  levels.   This  curve  is  the  supply  curve  of  reliability 
and  is  useful  in  finding  an  optimal  level  of  reliability  if  we  can 
provide  the  proper  marginal  value  of  REB  reliability  consistent  with 
the  ultimate  MOE. 

If  one  assigned  a  constant  price  or  value  for  one  unit  of 

reliability  percentage  ,  this  price  would  be  proportional  to  the  fractional 

2 
cost  "  of  the  missile  system  required  to  place  one  weapon  on  target 


This  assumes  that  the  price  of  product  is  constant  no  matter  what 
quantity  of  product  is  supplied,  or,  in  other  words,  that  all  units  of 
AR  are  of  equal  value  to  the  customer. 

o 
By  fractional  cost  we  mean  the  total  cost  of  the  missile  system 

divided  by  the  number  of  weapons  that  system  will  deploy.   We  wish  to 

reserve  the  term  average  cost  for  total  cost  of  reliability  improvement 

effort  per  weapon  divided  by  units  of  reliability  improvement  attained. 
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divided  by  100%.   For  this  purpose  what  is  meant  by  cost  of  the  missile 
system?   It  is  certainly  more  than  the  initial  investment  cost  of 
missiles  and  also  more  than  the  investment  cost  of  missiles  and  the 
remainder  of  the  system,  such  as  the  launch  platform  and  maintenance 
facilities.   The  most  suitable  cost  would  seem  to  be  the  present  value, 
referred  to  the  start  of  some  planning  period,  with  all  investment  and 
operational  costs  of  the  entire  missile  system  included  over  the  expected 
life  cycle  and  discounted  at  an  appropriate  interest  rate.   Less  than 
100%  reliability  can  result  in  a  weapon's  failure  to  function  any  time 
during  its  life  cycle.   This  manner  of  using  present  value  to  relate 
to  price  of  product  implicitly  assumes  constant  probability  of  use  in 
anger  throughout  the  life  cycle.   This  assumption  may  not  be  easily 
defended  but  is  no  less  reasonable  than  any  alternative  assumption  in 
this  regard.   The  cardinal  value  is  not  too  significant  in  the  analysis 
for  the  following  reasons.   We  will  be  comparing  the  price  of  product 
to  the  cost  of  reliability  percentage  at  the  margin.   It  seems  logical 
that  the  reliability  units  at  the  margin  will  not  be  as  valuable  to 
the  consumer  as  the  reliability  units  in  the  lower  range  of  reliability. 
First  consider  this  matter  if  the  mission  were  deterrence.   Certainly 
anything  above  zero  reliability  is  of  some  value  and  its  unit  value 
may  increase  as  reliability  improves  to  a  significant  level  of  capability 
Eventually  we  expect  marginal  value  to  decrease,  and  the  level  needed 
for  any  given  confidence  of  deterrence  becomes  very  fuzzy.    Next,  if 


Of  course,  all  that  is  really  needed  for  deterrence  is  the  enemy's 
belief  in  the  destructive  capability  of  the  system.   It  has  been  said 
that  if  the  missiles  were  not  ready  on  time,  the  first  POLARIS  sub- 
marine should  have  gone  to  sea  with  telephone  poles  in  the  missile 
tubes.   But  in  our  society  it  would  be  difficult  to  convince  the  enemy 
we  had  an  effective  weapon  system  if  we  did  not  believe  it  ourselves. 
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the  MOE  were  capability  of  destruction  of  given  portions  of  the  value 
of  a  target  complex,  in  most  targeting  schemes  we  would  still  have 
diminishing  returns  as  the  number  of  weapons  on  target  increases. 
The  price  of  product  based  directly  upon  the  fractional  cost  of  the 
missile   system  may  thus  be  looked  upon  as  an  upper  bound  of  the  value 
of  the  product  as  implicitly  determined  by  the  decisions  of  some  higher 
levels  of  authority  in  making  an  investment  in  the  system. 

Tms  manner  ot  prorating  costs  to  each  weapon  in  the  case  of  a 
tactical  missile  system  would  result  in  estimates  of  price  of  product 
of  considerably  lower  order  of  magnitude  than  for  a  strategic  missile. 
This  would  not  be  due  alone,  or  possibly  not  even  primarily,  to  the 
lower  cost  of  the  tactical  missile.   A  major  difference  is  that  many 
missiles  may  be  used  in  each  launch  facility;  that  is,  there  is  a 
capability  to  reload  in  the  tactical  systems  while  the  strategic  systems 
are  only  supported  for  a  one-shot  war.   If  many  reloads  are  expected, 
the  cost  of  the  entire  system  is  divided  by  a  large  number  in  prorating 
cost  to  each  weapon.   A  common  practice  in  cost  effectiveness  studies 
of  assuming  the  military  worth  of  a  weapon  equal  to  the  cost  of  the 
weapon  alone  then  is  not  too  bad  in  this  event.   On  the  other  hand, 
the  costs  of  some  of  the  activities  to  improve  reliability  for  the 
tactical  weapons  may  not  be  that  far  removed  from  similar  costs  on 
the  strategic  weapons,  particularly  in  the  category  of  direct  costs 
as  opposed  to  opportunity  costs.   Thus,  we  might  expect  some 


This  conclusion  follows  because  the  expectation  of  weapons  which 
will  detonate  on  target  is  a  direct  multiplicative  factor  of  expected 
reliability.   The  value  of  product  (  A R)  then,  if  calculated  by  pro 
rata  costs  of  the  entire  system  and  treated  as  constant  throughout 
the  range  of  AR  provided,  would  be  too  high  at  the  margin  of  reliability 
improvement  due  to  the  decreasing  utility  of  unit  A  R  as  reliability 
increases . 
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dramatically  different  conclusions  on  how  far  to  pursue  reliability 
improvement  in  the  different  systems. 

B.  Generalized  Lagrange  Optimization  Problem 

If  we  consider  several  different  activities  to  improve  reliability 
the  efficient  combination  of  those  activities  is  a  constrained  optimi- 
zation problem: 

Maximize  X  where  X  =  AR,  the  increase  in  reliability  above  some 
baseline  design  value;  subject  to  Vc.  =  C  where  C.  is  the  total 
cost  of  each  activity,  and  the  summation  is  over  all  activities. 

Where  the  X  under  consideration  is  a  small  range  of  potential 
reliability  improvement  and  the  number  of  activities  each  with  small 
individual  payoff  is  limited,  it  may  be  reasonable  to  consider 
X  =  /,X.  where  X.  is  the  AR  from  each  activity,  in  spite  of  the 
interdependencies  which  exist  over  large  ranges  and  being  careful 
to  throw  out  non-feasible  solutions  where  the  level  of  some  activities 
might  make  the  assumed  cost  versus  payoff  of  other  activities  incorrect 
The  relation  between  each  X.  and  its  corresponding  C.  would  be 
expected  to  be  a  set  of  numbers  corresponding  to  different  design 
options  or  program  plans.   The  X.  is  the  expected  reliability 
improvement  from  that  activity  level  and  C.  the  expected  cost,  either 
pecuniary  or  opportunity.   Instead  of  having  only  a  monetary  cost 
constraint,  one  could  conceive  of  several  other  constraints,  such 
as  allowable  accuracy  degradation  or  weight  allocation.   Indeed, 
in  the  usual  way  of  doing  business  these  type  of  constraints  are 
likely  to  be  dictated  to  the  development  activity.   But  if  the  valid 
MOE  is  kill  potential  on  target,  assignment  of  an  accuracy  requirement, 


23 

for  example,  by  higher  authority  implies  that  the  suboptimization 
problem  for  weapon  development  activities  has  been  solved.   It 
appears  more  logical  to  translate  all  the  constraints  into  pecuniary 
or  opportunity  costs  in  monetary  terms  and  then  look  for  the  efficient 
solution  for  use  of  development  activities. 

Thus  to  solve  the  suboptimization  problem  of  where  to  put  the 
reliability  improvement  effort  we  have  a  problem  with  the  following 
characteristics:   Maximize  a  payoff  function,  reliability  improve- 
ment X,  made  up  of  the  sum  of  several  semi-independent  activities 
each  producing  an  X .  at  a  cost  C,  with  an  over-all  constraint  of 
/  ^C .  =  C.   Since  we  are  not  putting  great  faith  in  a  particular 
quantitative  value  of  an  optimum  solution,  we  want  a  technique  which 
gives  considerable  insight  into  the  qualitative  nature  of  the  parameters 
without  unduly  extensive  computation.   The  technique  suggested  is 
that  of  the  Generalized  Lagrange  Multiplier  Method  described  in 
reference  13   for  solving  problems  of  optimum  allocation  of  resources, 
which  can  be  applied  similarly  here  for  optimum  allocation  of  relia- 
bility improvement  activities,  each  utilizing  the  one  monetary 
resource.   For  each  activity  we  will  maximize  the  unconstrained 
function 

X.  -  MC 
1      l 

where  m  is  the  Lagrange  multiplier  for  the  over-all  problem.   We  do  this 
for  a  range  of m values .   Then  a  set  of  X.  and  C.  which  is  feasible 


A  more  complete  explanation  of  application  of  the  Generalized 
Lagrange  Multiplier  Method  to  this  problem  is  given  in  Appendix  1. 
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represents  optimal  solutions  to  the  overall  problem 

Maximize:   X  =/  ^X  . 


Subject  to^C.  =  C 


1 
A  plot  of  C  versus  X  for  various  m  values  will  build  up  a  total  cost 

curve  from  which  we  can  derive  average  and  marginal  cost  cruves.   As 

in  the  ordinary  Lagrangean  formulation,  the  m  corresponding  to  any 

dX      1 
solution  point  is  -r^     or  —   equals  the  marginal  cost  of  the 

reliability  improvement. 

It  should  be  emphasized  that  when  speaking  of  average  and 
marginal  costs  the  quantity  of  product  referred  to  is  units  of 
reliability  (or  units  of  hazard  product  as  defined  in  section  IB). 
In  normalizing  these  costs  to  be  applicable  to  one  weapon,  of  course, 
some  calculations  are  carried  out  in  the  usual  sense  of  a  fixed  cost 
for  a  certain  development  activity  and  unit  cost  per  weapon  for  the 
same  activity.   Thus  our  C.  (a  total  cost  in  terms  of  product  X.) 
when  a  pecuniary  cost  is  actually  a  sum  of  (1)  a  per  weapon  cost  and 
(2)  the  quotient  of  a  fixed  cost  divided  by  the  number  of  weapons 
proposed  for  total  production.   It  is  clear  that  opportunity  costs 
as  used  here  must  be  calculated  so  as  to  be  applicable  to  one  weapon 
deployment  capability  in  the  fleet  in  order  that  they  may  be  added 
directly  to  the  normalized  pecuniary  costs  (neglecting  a  small  amount 
of  spares  which  would  bring  production  totals  above  deployment 
capability) . 

Consider  a  hypothetical  program  where  the  weapon  is  an  REB  for 
a  strategic  missile.   The  warhead  in  the  REB  will  be  caused  to 
detonate  at  a  prescribed  height  above  target  by  an  electronic  arming 
and  fuzing  device  (AFD)  in  the  REB.   We  will  assume  that  all  the 
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fallibility  (reliability  reduction)  comes  from  the  AFD.   Let  us  assume 
we  want  to  decide  upon  design  alternatives  in  four  activity  areas 
of  reliability  improvement  to  a  basic  design  which  presently  exists 
with  an  expected  initial  reliability  of  R  resulting  therefrom. 
Expected  reliability  improvement  and  cost  estimates  for  different 
levels  of  intensity  are  needed  for  each  activity  in  order  to  tabulate 
the  reliability  improvement  (X.)  versus  cost  (C.)  relationships  for 
use  in  a  generalized  Lagrangean  calculation.   The  activities  chosen 
and  an  approach  for  generating  the  X.  versus  C.  relationships  are 
described  in  Appendix  2. 


C.   Generalized  Lagrangean  Calculation 
To  illustrate  use  of  the  generalized  Lagrangean  we  will  assign 
some  numbers  to  our  hypothetical  missile  development  program. 

Assume  a  missile  system  whose  projected  present  value  of  cost 
exclusive  of  provision  of  the  REB's  at  the  beginning  of  a  ten-year 
planning  period  is  20  billion  dollars.   The  system  has  launch  facilities 
for  500  missiles,  which  pro  rates  40  million  dollars  per  missile, 
neglecting  consideration  of  spares.   If  each  missile  carries  ten 
REB's,  this  fro  rates  four  million  dollars  per  REB,  and  assuming 
one  million  dollars  for  the  cost  of  the  basic  REB,  we  assign  a  value  to 
deployment  of  each  REB  of  five  million  dollars.   Calling  this  the 
worth  of  close  to  100%  reliability,  we  assign  a  price  of  AR  as  50 
thousand  dollars  per  one  percent  of  AR. 

Assume  the  basic  REB  design  has  an  expected  reliability  of  90% 
and  the  (X.  =  AR)  versus  C.  relationships  obtainable  for  activities 
i  =  1  to  4  are  estimated  to  be  that  shown  in  Table  I.   The  activity 
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numbers  refer  to  those  described  in  Appendix  2.   We  will  keep  in 

3 
mind  an  additional  constraint  that  a  solution  which  shows  Y]    X .  >  6 

i =1  x 

is  not  feasible,  the  reason  being  that  activity  #4  could  not  produce 
reliability  improvements  at  costs  given  due  to  decreasing  marginal 
returns  if  this  high  an  aggregate  intensity  level  for  the  first  three 
were  used. 


i 

X.  (%) 

Ci  (K$) 

1 

1 

25 

2 

100 

3 

300 

2 

1 

10 

2 

50 

3 

200 

3 

1 

20 

2 

70 

3 

300 

4 

1 

10 

2 

40 

3 

100 

i   =  activity  index  number 
X.   =  reliability  improvement 
C.   =  cost  of  reliability  improvement 


TABLE  I.    RELIABILITY  IMPROVEMENT  VERSUS  COST 
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Next  we  use  various  values  of  m  and  compute  X.  -  mC   Results 
are  shown  in  Table  II.   The  asterisk  values  in  the  table  trace  out 
the  unconstrained  maximizations  for  each  activity  level.   The  X.  and 
C.  corresponding  to  these  values  are  added  to  give  the  total  X  and 
C  for  each  value  of  m .   Average  and  marginal  costs  are  then  calculated 
as  shown  and  plotted  in  Figure  1. 

Note  the  plot  shows  that  if  we  continue  to  price  the  product  at 
50K$  and  use  marginal  cost,  we  will  choose  a  program  with  an  expected 
reliability  of  96  or  97  percent.   However,  if  average  costs  are  used, 
which  may  be  done  in  effect  even  though  a  conscious  attempt  at  pricing 
the  product  is  not  done,  the  cost  curves  indicate  one  should  push 
beyond  the  99%  level. 
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M 

i    X. 

1 

.01 

.011 

.02 

.025 

.03 

.04 

1    1 

2 
3 

.75 

1.0* 
0 

.725 
.90* 
-.30 

.5* 
0 
-3.0 

.625 
-.50 
-4.5 

.25* 
-1.0 
-6.0 

0* 
-2.0 
-9.0 

2     1 
2 
3 

.9 
1.5* 

1.0 

.89 

1.45* 
.80 

.8 
1.0* 
-1.0 

.75 
.75* 
-2.0 

.7* 

.5 
-3.0 

.6* 
0 
-5.0 

3     1 
2 
3 

.8 
1.3* 

0 

.78 
1 .  23* 
-.30 

.6 
.6* 
-3.0 

.5* 
.25 
-4.5 

.  4- 
-  .1 
-6.0 

.  2" 
-  .8 
9.0 

4      1 
2 
3 

.9 
1.6 
1.6* 

.89 
1.56* 
1.46 

.8 

1.2* 

.2 

.75 
1.0* 
-.5 

.7 
.8* 
-1.2 

.6* 
.4 
-2.6 

3 

6 

6 

5 

4 

3 

3 

4 

9 

8 

7 

6 

5 

4 

&VC 

360 

260 

185 

135 

95 

65 

c 

AC  =x. 

40 

32.5 

26.4 

22.5 

19.0 

16.3 

MC  =  ^L-       10°          75         50       40        30 
A  X 

X  -  rel iability  improvement 

C  =  cost  for  reliability  improvement 

AC  =  average  cost 

MC  =  marginal  cost 

m  =  Lagrange  multiplier 


TABLE  II.   (X.  -mC.)  FOR  VARIOUS  VALUES  OF  M  AND  COST 

CALCULATIONS 


29 


Cost   (K$) 
100 


30 


60 


Price  of  AR 


Marginal 
Cost 


40 


:0 


X 


X 


D 


4         6 
X  =AR  (%)  above  90% 


10 


n 


FIGURE  1    AVERAGE  AND  MARGINAL  COST  FOR  RELIABILITY  IMPROVEMENT 


III.   MAINTENANCE  OF  RELIABILITY 
A.   Reliability  Model 

In  this  chapter  we  will  consider  the  problem  of  selecting  an 
optimum  design  alternative,  taking  into  account  the  degradation  during 
dormant  conditions.   We  will  be  looking  for  a  minimum  cost  solution  to 
obtain  a  given  effectiveness  level  as  a  function  of  (1)  the  initial 
reliability  and  (2)  the  planned  frequency  of  periodic  tests  to  find 
and  correct  failures  rates  which  occur  during  dormancy. 

For  an  example  of  how  dormant  failure  rates  might  be  important, 
we  will  consider  a  simplified  FTS  for  the  REB  of  a  hypothetical  ballistic 
missile  shown  in  Figure  2.   There  is  an  electronic  AFD  of  given  series 
complexity  in  the  REB.   The  AFD  is  dormant  until  it  rides  a  missile 
after  aging  for  time  t.   It  is  activated  after  time  t  of  missile  flight 
and  must  operate  for  time  t  during  re-entry  before  sensing  the  target 
and  detonating  the  warhead.   The  expected  hazard  products  during  each 
phase  are  shown  at  the  top  of  each  box.   Assume  failure  rates  and  times 
shown  below: 


Rate  (failures  per  hour) 


x   =  2-10 

^  =  .05 


x3  =  1.0 


-5 


Time 


t  =  10  years  (8.76-10  hours) 


t2  =  2  minutes  (3.34-10   hours) 

_2 
t„  =  1  minute  (1.67-10  '  hours) 


Then,  the  expected  hazard  products  and  corresponding  reliabilities 

—      9  9   "3  ^ 

are  as  shown  in  Table  III.   The  reliability  when  new,  RQ  =  e 
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drops  from  98.1%  to  17.1%  at  the  time  of  firing.   If  A   were  a  factor 
of  10  lower,  the  resultant  reliability  would  be  82.5%  or  a  reduction 
of  about  16%  from  R  . 


\j_t 


Storage 

and 
Dormant 

(non -opera ting) 


x2t2 


V3 


Boost 
and 
Flight 

(non-operating) 

__ . 

R-entry 
(operating) 

Phase  1 


Phase  2 


Phase  3 


FIGURE  2.   FACTORY-TO-TARGET  SEQUENCE  (FTS) 


\.t. 

i  i 

R. 

l 

A  t 

lr 

A2t2 

1.75 
.00167 
.0167 

.174 
.998 
.983 

EVi 

1.768 

.171 

t . 

1 


x  t 


=  failure  rate  in  failures  per  hour 
=  time  in  hours 
=  hazard  product 


R.  =  e 


.x±t. 


TABLE  III.   HAZARD  PRODUCTS  AND  RELIABILITIES 
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If  a  constraint  were  imposed  that  reliability  must  not  be  below 
90%  (R>R*  =  .9)  during  a  service  life  of  ten  years,  under  the  wooden 
bomb  philosophy  the  constraint  would  be  violated.   A  no-test  solution 
would  be  complete  replacement  of  AFD's  corresponding  to  their  age  when 
reliability  drops  to  the  constraining  level.   This  is  likely  to  be  a 
very  high  cost  solution.   Another  approach  involving  no  tests  might 
be  feasible  in  a  case  where  R  of  the  basic  design  and  R*  are  lower, 
allowing  room  for  improvement  in  reliability  of  the  basic  design  to 
increase  the  gap  between  R  and  R*  enough  to  allow  for  degradation  with 
age.   In  addition  to  monetary  costs  of  a  higher  reliability  design 
we  would  have  degradation  in  the  performance  portion  of  the  MOE  due 
to  the  larger  weight  and  volume  of  the  AFD.   This  solution  may  in 
many  cases  be  technically  impossible  because  of  the  limited  size  of 
the  gap  between  R*  and  100%,  and  the  difficulty  of  increasing  Rn  as  it 
approaches  100%. 

To  consider  how  often  periodic  testing  might  be  economically 
efficient  to  cull  out  failures,  one  must  first  determine  whether  or 
not  reliability  improvement  is  even  feasible  from  a  test  and  maintenance 
cycle.   This  has  been  analyzed  for  missile  reliability,  not  considering 
degradation  with  age  but  from  the  viewpoint  of  raising  the  reliability 
of  a  lot  of  missiles  by  test  and  maintenance  14  .   The  model  has  the 
following  parameters : 

a   =  probability  of  a  reliable  missile  being  rejected 
by  test  (producer's  risk) 

3  =  probability  of  an  unreliable  missile  being  accepted 
by  test  (consumer's  risk) 

7  =  degradation  of  missile  reliability  during  test  and 
maintenance  cycle 
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P_  =  probability  that  a  missile  will  be  repaired 
during  maintenance  cycle 


Equations  are  derived  for  the  new  reliability  of  a  lot  for  given 
parameters.   For  example,  using  values  of 


a       - 

=      .10 

&       ~- 

=      .20 

y     - 

=      7% 

PR      = 

=      .90 

the  author  found  that  for  initial  reliability  of  a  lot  greater  than  .892 
the  result  of  test  and  maintenance  is  a  worsening  of  the  reliability  of 

A  R 

the  lot  tested.   He  then  defines  efficiency  as    0   and  effective 

Ro 

maintenance  cost  as  maintenance  cost  divided  by  efficiency,  and  shows 

that  effective  maintenance  cost  doubles  in  the  region  of  Rn  from  80  to 

85%,  and  of  course  becomes  infinite  near  89%  for  the  above  parameter 

values . 

Let  us  assume  that  for  our  REB  maintenance  cycle  we  have  condensed 

these  parameters  into  a  factor,  "a",  which  is  the  fraction  of  failures 

discovered  and  corrected,  assuming  negligible  degradation  during  test. 

Then  to  the  FTS  we  add  a  repair/replace  loop  as  shown  in  Figure  3. 

For 

a  =   .9 

tA   =  9^  years  (dormant  time  before  test) 
t(.   =  \   year,  (dormant  time  after  test) 
we  get  the  results  shown  in  Table  IV  for  the  two  X  values  considered 
earlier.   The  reliability  after  ten  years  without  testing  compared 

If  not  assuming  negligible  degradation  during  test  we  could  still 
define  an  "a"  such  that  (1  -  a)  times  the  original  number  of  failures 
is  the  number  of  failures  in  the  lot  after  the  maintenance  cycle. 


Xlfc4 


Storage 

and 
Dormant 


Phase  la 


"a  V4 


If  good 


If  bad 


Repair/ 
Replace 


xt 


Storage 

and 
Dormant 
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To  Phase  2 
(Boost 
and 
1       Flight) 


Phase  lb 


FIGURE  3.   FTS  WITH  TEST  AND  REPAIR/REPLACE  LOOP 
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X   =  2  •  10~5 

X   =  2  •  10"6 

X.t. 
l  i 

R. 

l 

X.t. 
l  l 

R. 

l 

(1  -  a)Xjt4 

xxt5 

X2t2 
V3 

.166 
.0876 
.00167 
.0167 

.847 
.916 
.998 
.983 

.0166 
.00876 
.00167 
.0167 

.9835 
.9913 
.998 
.983 

£  x-t. 

.272 

.762 

.0437 

.957 

dormant  failure  rate  (failures  per  hour) 

fraction  of  failures  corrected  in  maintenance 
cycle 


(1  - 


a)\t4 


hazard  product  after  dormant  time  t .  and 
maintenance  cycle 


*t 


hazard  product  after  test  cycle  during  dormant 
time  tr 


x2t2 

3    3 


[•' 


hazard   product  during  boost 
hazard   product  during   re-entry 

-xiti 


TABLE  IV.   RESULTS  OF  MAINTENANCE  CYCLE 
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to  the  case  with  testing  for  the  two  dormant  failure  rates  is: 
17.1%  raised  to  76.2% 
82.5%  raised  to  95.7%. 

B.   Problem  Analysis  for  Absolute  Minimum  Reliability  Requirement 

For  simplification  of  cost  analysis  let  us  condense  the  FTS  even 
more  and  assume  that  all  failures  occur  during  dormancy  time  before 
missile  flight  and  operating  time  during  re-entry. 

Then,  at  time  t  the  hazard  product 

\  -  Vi 

and  after  test  and  repair/replace  the  hazard  product 


For  periods  of  equal  length  t  between  testing,  after  n  periods: 
hnt   -   (l-a)n_1  +  (l-a)n_2   +  ....(1-a)  +  ll  X^ 

h'nt   =    (l-a)n  +  (l-a)n_1  +  ....(l-a)l  X^ 


These  two  expressions  are  derived  as  follows.   After  each  period 
of  length  t  ,  X  t   is  added  to  the  hazard  product.   After  each  maintenance 
cycle  the  resultant  hazard  product  is  obtained  by  multiplying  by  (1  -  a). 
For  example,  for  n  =  2: 


X'S  +  Vl    (  1  "a)Vl  +  Xih 


(1    -   a)    +   ll   X1t1 
ti    =[d    -a)2   +    (1    -a)] 


h'2tl  =  d  -  a)  h2ti 
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Neglecting  terms  of  (1  -  a)  raised  to  power  of  two  or  more 


hntl     <2  "  a>  Vl 


Then  for  some  selection  of  t   in  combination  with  a  given  initial 
reliability  RQ  corresponding  to  RQ  =  e"  °  where  h  =\   t   is  called 
the  initial  hazard  product,  the  total  hazard  product  h  versus  time 
over  a  service  life  of  length  T  =  nt  would  look  like  Figure  4. 

Let  us  examine  a  solution  for  the  case  where  higher  authority 
prescribes  an  absolute  minimum  reliability  level  as  a  requirement. 
This  may  not  be  the  most  logical  way  to  consider  the  allocation  of 
reliability  effort,  but  it  may  often  be  the  actual  conditions  under 
which  it  must  be  done.   For  many  institutional  and  administrative 
reasons  what  should  be  treated  as  a  first  approach  reliability  goal 
may  become  a  firm  requirement.   This  would  imply  that  the  higher 
authority  knows  in  absolute  terms  the  maximum  effectiveness  necessary 
to  achieve  a  certain  result  -  such  as  a  given  kill  capability  to  assure 
deterrence . 

Suppose  a  constraint  is  set  that  each  REB  never  have  a  total  hazard 
product  greater  than  h*  (R  >  e"   ).   Let  us  assume  that  the  REB  has 
a  basic  h  which  will  not  meet  the  constraint  as  a  wooden  bomb  throughout 
its  service  life,  but  improvement  in  initial  reliability  is  possible, 
and  correction  of  dormant  failures  through  test  and  maintenance  is 
feasible.   The  cost  function  CT  for  each  REB  will  be  made  up  of  three 
parts : 


h 


/ 


/ 


/ 


/ 
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hQ    +  XXT 


7 


/ 


/ 


/ 


/ 


/ 


/ 


/ 


/ 


•' 


/ 


ho +  w  / 


hQ    +    (2    -  a)Xlt 


V\        (1    -   a)X  t 


11 


nt. 


FIGURE  4.   HAZARD  PRODUCT  VERSUS  TIME 
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(1)  C(hn)   =  the  cost  of  obtaining  a  given  initial  reliability 

as  computed  by  the  generalized  Lagrangean  technique 

(2)  Cost  of  testing,   C  T   ,  where 


C   =  cost  of  a  test  (monitoring)  operation 
T   =  prescribed  service  life 

(3)   Expected  cost  of  repair  or  replacement  for  failures 

detected,  C  -(a  XT),  where 
'   r     1 

C   =  average  cost  of  a  repair  operation. 


We  will  consider  the  third  term  as  a  fixed  cost,  not  a  function  of 
1 


hn  and  t 


We  also  assume  "a"  and  X   are  not  functions  of  h 


2 


To  be  plausible  for  C  ,  this  assumes  ability  to  repair  the  AFD. 
C  would  be  a  strong  function  of  hn  if  replacement  were  made.   But 
even  complete  replacement  might  be  much  smaller  than  C(hn)  which  is 
dominated  by  opportunity  costs.   If  the  AFD  could  not  be  replaced  so 
that  C  was  on  the  order  of  a  complete  REB  cost,  then  the  term  probably 
becomes  of  more  significance  relative  to  C(h„) . 

2 
The  assumption  would  be  totally  unrealistic  for  X   if  the  "basic" 

reliability  were  of  low  order.   For  then  the  measures  taken  to  improve 

hn  in  the  area  of  manufacturing  and  quality  control  would  be  assumed  to 

reduce  dormant  failures,  which  are  due  largely  to  built-in  defects. 

However,  on  the  assumption  th^t  some  of  these  built-in  defects  cannot 

be  detected  by  testing,  the  improved  screening  process  will  not  discover 

them,  and  it  is  likely  that  the  process  cannot  be  improved  to  eliminate 

a  detect  whose  nature  is  not  known.   In  some  regime  of  high  initial 

reliability,  \      may  be  almost  independent  of  h  .   If  we  assumed  that  u-^ 

would  remain  approximately  a  constant  proportion  of  u~,  which  is  indicated 

by  statistical  results  in  some  reliability  regimes,  we  could  represent 

\     as  a  constant  times  h  .   The  following  analysis  could  be  carried  out 

on  this  basis,  but  the  results  would  be  much  more  complex  to  analyze. 

Note  also  that  C  would  be  expected  to  be  a  decreasing  function  of  hQ 

while  x   would  increase  with  h  .   Thus  the  changes  due  to  hQ  would  tend 

to  cancel  each  other. 
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The  problem  then  is  to  minimize: 

C  T 
CT(hQ,t1)  =  C(hQ)  +  -^—       +  Cr  •  (aAxT) 


subject  to 


hQ  +  (2  -  a)  •  X  t^h' 


Note  that  for  a  given  h  the  constraint  equation  determines  t 
because  the  largest  t  possible  will  minimize  cost  for  the  given 
h  .   That  is,  the  equality  will  hold  in  the  constraint  equation  at 
an  optimal  solution.   We  can  thus  compute  total  costs  for  each  of  the 
h  values  corresponding  to  design  alternatives  for  which  C(hn)  values 
were  computed  by  the  generalized  Lagrangean.   Results  of  such  a  computa 
tion  are  shown  in  Table  V  for  the  following  parameters: 


C   =  1  (K$) 
m 


8.76  •  104  hours 


.9 


X    =  2.10    per  hour 

C   =  unassigned  because  the  fixed  cost  does  not  affect 
the  optimization 

h*  =   .10  and  .06   (R*  =  90%  and  94%  respectively) 

Variable  Cost  (VC)  =  C(hQ)  +   CmT   . 


Note  that  for  R*  =  90%  no  minimum  cost  is  found  in  the  regime  of 
design  alternatives  considered  although  the  values  seem  to  be  quickly 
approaching  a  minimum  near  the  lowest  value  of  R„  equal  94%.   In  this 
case  we  might  guess  that  there  is  something  inconsistent  in  the  value 
judgments  which  resulted  in  spending  the  total  amounts  indicated  for 
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h*  =  .10  (R*  =  90%) 

R0  (%) 

ho 

C(hQ) 
(K$) 

fcl 

3 
(10  hours) 

C  T 
m 

*1 

VC 
(K$) 

(K$) 

99 

.01 

360 

4.10 

21.4 

381 

98 

.02 

260 

3.64 

24.1 

284 

97 

.03 

185 

3.17 

27.6 

213 

96 

.04 

135 

2.72 

32.2 

167 

95 

.05 

95 

2.27 

38.6 

133 

94 

.06 

65 

1.82 

98.2 

113 -•— 

h*  =  .06 

(R*  =  94%) 

99 

2.27 

38.6 

399 

98 

1.82 

48.2 

30  8 

97 

1.36 

64.3 

249 

96 
95 

.910 
.455 

96.5 
193 

ooo  ^_. 

288 

94 

0 

h-   -  maximum  hazard  product  allowable 

R"   =  e 

-hn 
R   =  initial  reliability  =  e 

t   =  period  between  tests 

C(h  )  =  cost  of  initial  reliability 

C  T 
— - —  =  cost  of  testing 

1 

C  T 
VC   =  variable  cost  =  C(hQ)  +  — = — 


TABLE  V.   TABULATION  TO  FIND  MINIMUM  VARIABLE  COST  AS  A 
FUNCTION  OF  hQ  AND  t 
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the  total  program  but  would  then  set  R*  as  low  as  90%.   For  R*  =  94% 
the  minimum  cost  is  found  at  R„  =  96%.   In  summary,  the  solutions  are: 

R*  =90%      R*  =  94% 
RQ  <  94%  96% 

t   (hours)  <1.82'103        .910-  103 

n  >48  96 

Of  course,  if  we  examine  the  technical  and  operational  constraints, 
an  indicated  optimum  solution  may  not  be  feasible. 

Next  let  us  pose  the  cost  minimization  problem  for  solution  by  use 
of  a  Lagrangean  with  the  constraint  expressed  as  an  equality.   As  will 
be  indicated,  it  is  not  particularly  useful  in  this  case  as  a  method  of 
finding  the  optimal  solution  but,  as  pointed  out  by  Samuelson  in 
reference   15   ,  it  is  often  possible  by  using  this  framework  to 
determine  the  qualitative  behavior  of  solution  values  in  respect  to 
change  of  parameters . 


For  example,  the  solution  for  the  R*  =  94%  case  calls  for  a 
monitoring  operation  approximately  every  5^  weeks.   The  C  assigned, 
if  based  only  on  the  pecuniary  cost  of  the  monitoring  operation,  assumes 
the  REB  would  be  available  for  test  anyway,  presumably  to  coincide  with 
down  time  on  some  other  part  of  the  weapon  system.   If  this  were  not 
the  case  and  C  had  to  cover  weapon  unavailability  costs,  C  would  be 
much  larger  ana  more  dominating  in  the  solution.   Also,  we  are  assuming 
the  number  of  tests  over  a  service  life  is  not  large  enough  to  cause  the 
failure  rate  of  any  of  the  components  to  move  into  the  wearout  region. 
This  is  a  function  of  the  nature  of  the  monitoring  operation.   We  could 
reduce  the  thoroughness  of  the  test  to  avoid  wearout  but  would  also 
inevitably  reduce  "a",  the  fraction  of  failures  corrected  which  depends 
on  the  number  detected.   So  in  the  end,  if  none  of  the  solutions  look 
feasible,  we  reconsider  the  basic  design  (perhaps  allowing  more  for  the 
characteristic  that  our  devices  be  amenable  to  testing)  and  recompute 
the  C(hn)  relationships. 
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Let  the   Lagrangean, 


CL    =   CT    -  M 


hQ   +   (2    -  a)    •   x1t1   -  h 


'] 


First  order  conditions  for  an  extremum: 


acT 


ac 


acr 


T   -   m   =  0 


or    m 


TFT 


ah, 


ah, 


ac 

ahr 


acT 


acr 


dt. 


at. 


(2  -  a)  Xim 


where  dCr 


-C  T 
m 


at. 


ac, 


ax 


-  h   -  (2  -  a)  X  t   +  h*  =  0 


1  dc 

It  follows   that   m  :     T    which  is  the  marginal  imputed  cost 


"HT77 


of  the  constraint 


"This  is  shown  by  taking  total  derivative  of  C  and  the  constraint, 


and  using  first  order  conditions 
dCm  = 


T    dh    +    ^CT     dt 

T   dhQ      _^_       dtx  =MdhQ  +  (.    a)  ^^^ 


0 


'1 


M(dhQ  +  (2  -  a)  \1  dtx) 


dh*  =  dhQ  +  (2  -  a)  xxdtx 


Then, 


dCr 


dh" 


=  M 
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To  solve  for  h  and  t  ,  note  that  by  using  the  last  equation 

we  can  express  t.,  as  a  function  of  h~  .   Then  if  we  could  express  ^r- 
^      1  0  dh„ 

as  a  function  of  h  ,  we  could  write  the  second  equation  with  h„ 
as  the  only  unknown  and  solve  for  h  .   However,  even  if  dC       were 

linear  in  h„  (which  in  general  it  is  not) ,  we  would  have  a  third  degree 
equation  to  solve  for  h„ .   In  our  discontinuous  example,  d  C   is 

approximated  by  straight  lines,  but,  to  take  advantage  of  this,  one 
would  have  to  guess  which  segment  would  contain  the  solution  point,  and, 
if  the  solution  is  near  a  change  in  slope,  the  answer  might  be  erroneous 
Thus,  the  iterative  tabular  method  seems  the  more  practical  for  getting 
an  indication  of  the  approximate  optimum  solution  in  this  case,  but 
it  depends  on  the  form  of  the  cost  information. 

Taking  the  total  differential  of  the  first  order  conditions  gives 
the  following  matrix  equation: 


a  cr 


ah, 


-i 


2C  T 
m 


-I 


-(2  -  a)X. 


(2  -  a)X1      0 


dh, 


dt. 


dM 


T   dC  +  C   HT 
9   m    m  a  1 


+  (2  -  a)Md\-L  -X-^da 


(2  -  a)  tld\1  -V^da 
-dh" 


4  5 


This  is  of  form  Ay  =  b  where 

A  is  the  bordered  Hessian  (the  Hessian  above  and  to  left  of  dotted 

line)  which  must  be  positive  definite  for  a  minimum,  a  condition  which 

32  1 

is  satisfied  if     C    is  positive  ,  which  is  true  over  the  relevant 

ah02 

range  of  hn  as  depicted  in  Figure  5,  which  is  plotted  from  the  information 
in  Table  II. 

Forming  y=  A  "  b 
allows  the  qualitative  examination  of  relations  between  parameters. 
For  example,  if   dT  =  dX  =  da  =  dh*  =  0, 


dtl                 T 
-  •  d  „        where 

m       t 

_i   refers  to  the  second  diagonal  element  of  A  "  which  is  known  to  be 
22 

positive.   This  shows  how  the  period  between  tests  increases  with  the 
cost  of  tests. 

To  illustrate  further  use  of  the  second  order  conditions ,  let  us 
put  in  the  values  for  our  solution  for  the  h*  =  .06  case.   The  values 
are  summarized  below: 


The  sign  of  the  determinant  must  be  negative  because  there  is  one 
constraint.   Expanding  by  the  first  column  gives 

T 


2 

d     CT  /  9     ?\~   >("m 


/  ,o  ^2   2V  2CmT 


e 


on        \  /   t, 

0  1 

2 
Thus  both  terms  are  negative  if    3  q      j[s  positive 

^7" 


(K  $) 
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06 


FIGURE    5.         COST  AND  MARGINAL   COST  VERSUS    INITIAL  HAZARD   PRODUCT 
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Solution  Values 


ho 

=    .04 

h 

=   910   hours 

n   = 

96 

Parameters 

T  =  8.76  •  104  hours 
-5 


C„  =  135  +  96  +  1.58  C 
T  r 

=  231  +  1.58  C 


1 

2 

10 

a   = 

.   ' 

C        = 

m 

=  1 

K$ 

h*  =  .06 


Using  these  values  th<=  matrix  equation  3fter  multiDlying  by  A 
becomes : 


-I 


dh 


dt. 


d  m 


1.72    •    10 


-6 


-7.83     •    10 


-2 


-.83 


■7.83 
-.83 


10 


-2 


3.56    •    10 3    -7.83-103 


-7.83-103       -8.3-104 


.106  dC      +   1.21.10~6dT 
m 

-4.95.103dX1   +   9.0-10"2da 


103dAx    -   1.82-10    2da 


dt. 


We  can  then  find 


dc 


-dh" 


377  and  deduce  that  t   will  increase  with 


ui 


C   but  proportionally  less  rapidly  by  about  1/3  from  the  equilibrium 
position. 

Since  dormant  failure  rate  may  be  a  parameter  with  very  large 
proportional  uncertainty,  let  us  examine  the  effect  of  its  change  with 
all  other  parameters  constant.   The  matrix  equation  shows 


3U_ 
d  X 


-    442 


d1 

"ax. 


l  = 


2.54  •  10 


a  m 


-  4.42  •  10 
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Suppose  A  X  =  10   ,  corresponding  to  a  50%  increase  in  failure  rate. 


Then, 


Ah   =  -  .004 


At   =  -  254  hours 


A  m  =  -  442  K$  per  unit  h  (greater  in  absolute  value) . 

The  h  and  m  solution  values  have  a  smaller  proportional  change 
(about  1/10)  than  t,  ,  which  must  be  decreased  by  about  \.      This  could 
be  an  encouraging  result  if  t  could  be  changed  easily  during  the 
operational  life  to  take  care  of  an  unexpected  dormant  failure  rate. 
But  it  may  not  be  the  case  and  indeed,  in  this  example,  it  was  indicated 
likely  that  the  optimal  solution  initially  called  for  would  probably  not 
be  feasible  because  of  t  being  too  short. 

These  results  suggest  that  it  may  be  most  practical  in  many 
systems  to  work  the  problem  sequentially  -  first,  finding  an  efficient 
solution  for  initial  reliability  allowing  for  the  possibility  of 
unfavorable  results  in  the  dormant  failure  rate  area;  later  maximizing 
the  return  over  time,  delaying  the  details  of  the  monitoring  program 
as  long  as  possible  in  order  to  utilize  the  best  predictive  information 
that  can  be  gleaned  from  the  program  before  making  the  decision  on  the 
nature  of  the  monitoring  program. 

C.   Problem  Analysis  for  Average  Reliability  Over  Time 

What  is  proposed  as  a  more  logical  approach  than  the  minimum 
reliability  requirement  of  the  previous  section  is  to  investigate 
what  average  reliability  level  over  time  can  be  attained.   This  seems 
better  for  several  reasons.   First,  the  likelihood  of  use  is  a  completely 
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random  event  for  which  average  values  over  time  are  appropriate  if  the 
swings  above  and  below  the  average  are  not  too  large.   It  appears  that 
our  answers  tend  to  point  toward  a  fairly  larger  number  of  test  cycles 
which  will  keep  the  variance  small.   Secondly,  the  variations  in  relia- 
bility plotted  over  time  are  for  a  single  weapon.   In  a  practical 
case  the  condition  of  different  groups  of  weapons  in  the  fleet  being 
in  different  parts  of  the  cycle  will  cause  a  smoothing  out  of  the 
average  reliability  over  time  when  looking  at  the  fleet  as  a  whole. 
And  it  is  this  average  as  a  whole  which  determines  the  effectiveness 
of  the  entire  weapon  system. 

Another  way  of  looking  at  the  objective  is  to  consider  that  the 
goal  is  to  maximize  the  proportion  of  time  which  the  weapon  is  good 
(no  dormant  failures  before  firing) .   This  viewpoint  allows  closer 
analogy  to  investigation  on  inspection  programs  for  randomly  failing 
equipment  in  systems  which  are  not  one-time  use  but  operate  more  or 
less  continually.   For  example,  the  paper  by  Weiss   16  which  refers 
to  some  of  the  many  earlier  papers  on  the  subject  says  that  the 
objective  of  any  checkout  program  is  to  minimize  the  down  time  due  to 
system  failure  (or  maximize  the  expected  operational  readiness  of  the 
system);  and  that  when  the  reliability  function  is  negative  exponential, 
the  optimal  checkout  policy  must  be  a  periodic  one.   It  is  not  considered 
important  here  to  rigorously  show  that  the  optimal  inspection  program 
is  periodic  because  practical  considerations  would  undoubtedly  dictate 


Of  course,  much  of  this  argument  is  valid  for  using  the  minimum 
reliability  requirement  also,  but  the  concept  of  adjusting  eff ectivenes: 
levels  dependent  on  the  cost  of  attainment  seems  more  palatable  when 
we  get  away  from  the  rigid  specification  of  a  minimum  requirement.   Also 
the  minimum  level  framework  may  tend  to  give  answers  which  pay  too  much 
for  avoidance  of  dropping  below  the  minimum  level  for  a  very  short 
period  of  time. 
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its  use,  the  advantage  of  simplicity  in  scheduling  the  checkouts 
outweighing  any  sit  all  theoretical  advantage  of  a  more  complex  program. 

Again  considering  the  problem  in  terms  of  hazard  product  and 
looking  back  to  Figure  4,  we  see  that  without  testing  over  the  service 
life  T,  the  expectation  of  hazard  product, 

h  +  (h  +  X  T)  X-.T 

h     =  -^ y ± —  =  h   +  —± — 

w.o.  £  2 

With  testing, 

[h0  +  (1  '  a)Xltl]  +  h0  +  (2  "  a)xiti] 


h 


ho  +  xi  (  2   )   fc: 


,  ,.     ■                  ,       3-2a 
or  defining     b  =  


h   =  hQ  +  bX  t 


Then  the  improvement  (decrease)  in  h  is  represented  by 

xl 

h     -  h  -  — —  (T  -  2bt,  ) 

w.o.         ?  1 

If  we  can  assign  a  value  P  to  a  unit  of  decrease  in  h,  then  the 
"revenue"  from  the  testing  program  is 

^P  X   (T  -  2bt1). 

As  before,  for  a  given  h  ,  we  can  represent  the  cost  of  the  testing 

program  as  p  „ 

C  =   — - —  +  C   •  a  x,T 

t       r      1 
1 
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We  could  then  find  t  to  maximize  "profit"  expressed  as  revenue  minus 

cost  or  \   Px]_  (T  -  2bt1)  -  (  CmT  +  c     {   x 

V  t]_    r      1 


) 


First  order  condition 


C  T 
dPA,       m   =  0 


or    t 


; 


C  T 
m 


bPA1 


Second  derivative 


-  2C  T 
m 


verifies  positive  root  corresponds  to  a  maximum  profit.   For  example, 
using  the  same  parameter  values  as  in  previous  section  for  the  h  =  .04 

design,  noting  that  b  =  .6  corresponds  to  a  =  .9,  and  assigning 

3 
P  =  5  •  10   K$,  our  upper  limit  of  the  value  of  unit  h,  corresponding 

to  50  K$  per  1%  of  AR,  results  in 


t   =1.21  '  103  hours       and 


n  =  72.5 
or  an  inspection  about  once  every  6.6  weeks. 

For  \      =2    •    10"  '  per  hour,  the  solution  would  be 

t   =3.82  *  103  hours 

n   =  23 
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or  about  once  every  five  months.   Thus,  reducing  the  estimate  of  dormant 
failure  rate  by  a  factor  of  ten  still  leaves  a  solution  which  calls 
for  considerable  inspection. 

For  an  analysis  of  the  parameters  consider  the  problem  in 
Lagrangean  format,  leaving  out  an  assigned  value  of  unit  hazard  product 
(P) .   The  problem  is  to  minimize 

C  T 
C  =  — —  +  C   -a  XnT 

*i       r        x 


subject  to 


h0  +  bxltl  =  h 


Note  that  once  all  parameters  are  assigned  the  constraint  equation 
determines  t  which  then  determines  the  cost  so  this  is  really  not  an 
extremum  problem  at  all.   However,  using  the  Lagrangean  format  as  in 
the  previous  section  allows  some  insight  into  the  nature  of  the 
solution  with  qualitative  change  of  parameters. 
The  Lagrangean:    C   =  C  -m  h   +  bX  t   -  h 

First  order  conditions : 

dCT    —  C  T 
L       m 


2   -bX^O 


dC 

=   -  hQ  -  bX  t   +  h  =  0 


ax 

L 


Of  course,  the  maximum  solution  could  be  at  a  point  of  negative 
profit  if  the  "fixed  cost"  term  containing  C  were  high  enough.   But 
this  term  is  not  expected  to  be  dominating  even  if  C   involved  complete 
replacement  because  of  P  being  much  larger  than  C  . 


Then 


tx  =  h  -  hQ 


bX. 
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M  - 


-  C  T 
m 


b¥i' 


-CmTbXl 
(h  -  hQ) 


dC 


:lh 


Taking  total  differential  of  the  first  order  conditions  and  multiplying 
through  by  inverse  of  Hessian  as  before  gives  the  following  matrix 
equation : 


dt. 


dM 


0 


b  X. 


-1 
b  X, 


1 


-  2C  T 
m 

~V — 2~     3 
b   X      t 
11 


-^y  dC      +  Cm     dT   +  bMdXn    +xnMda 
.2        m     *  1        1 

\         ^7 


bt  dX  +X  t  db  +  dh   -  dh 


To  compare  this  approach  with  the  (h  ,  t  )  optimization  case  of 
previous  section  where  we  set  h*  =  .06  and  found 


hQ  =  .04 


t   =  910  hours, 
our  constraint  equation  indicates  that  we  would  set 


h  =  .0532 


and 


M  =  - 


3 


83  •  10   K$ 


This m value  is  larger  in  absolute  value  than  the  value  of  product 
assigned  (P)  in  our  profit  maximization  calculation  so  the  smaller 
frequency  of  checking  in  that  calculation  is  consistent. 
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With  these  parameter  values  and  for  changes  in  X  only 

at  7 

—  =   -  4.55  •  10 


d\ 


^——     =   -  4.38  •  10 


ax 

1 


Then  if  ax   =  10 


At   =  455  hours 


~  3   A 

Am  =  -  4.38  •  10   K$  per  unit  h  (greater  in  absolute  value) 


Compared  to  the  (h  ,  t  )  optimization  case,  the  change  in  X 
has  a  much  greater  effect  on  the  solution  values,  -455  compared  to 
-254  hours  for  t  and  -4380  compared  to  -422  K$  per  unit  h  for  Am. 

Similarly  for  changes  in  b  only, 

dt, 

—  =  -  90  8 


6  b 


d  n  4 

^—   =   -  2.63  '  10 


a  b 

If  Ab  =  .1,  corresponding  to  A  a  =  -.1  (or  b  =  . 7  and  a  =  .8) 


At   =   -90.8  hours 


A  m  ^  -2.63-103  k$. 
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The  cost  in  the  testing  area  per  unit  h  is  seen  to  change  more 
rapidly  than  total  costs .   The  combination  solution  for  h„  and 
t   tended  to  mask  the  importance  of  high  "a"  in  keeping  down 
costs  . 

The  interdependency  between  some  of  the  parameters  is  also 

well  illustrated  graphically.   Looking  at  Mas  a  function  of 

3 
C  and  for  the  parameters  chosen,  m=  8.83  •  10   C   is  plotted  as 
m  m    v 

the  middle  line  in  Figure  6.   Choosing  h  so  as  to  reduce  (h  -  h  ) 

by  half  results  in  the  lower  line  and  doubling  (h  -  h  )  yields  the 

upper  line.   One  could  compare  the  intersection  of  the  chosen 

line  with  the  value  of  C  against  his  idea  of  the  value  of  the 

m 

product,  one  unit  of  h  reduction.   Starting  with  the  upper  line, 

one  would  want  to  reduce  h  until  the  indicated  m  or  marginal  cost 

equaled  the  value  of  the  product.   One  can  also  see  in  this  figure 

that,  dependent  on  the  choice  of  (h  -  hn ) ,  marginal  cost  may  or 

may  not  be  very  sensitive  to  C  .   For  (h  -  h  )  very  small  (little 

degradation  in  reliability  allowed)  marginal  cost  is  very  sensitive 

to  C  . 
m 

This  type  of  analysis  could  of  course  be  extended  to  investi- 
gate the  sensitivity  of  other  parameters  in  a  similar  manner. 
Those  parameters  whose  values  are  not  well  known  and  to  which  the 
solution  is  sensitive  then  provide  valid  warning  against  too  much 
confidence  in  the  indicated  design  solution. 

Thus  far  we  have  indicated  a  method  of  economic  analysis 
to  maximize  the  value  of  expected  reliability  minus  the  cost 
of  providing  it.   We  will  next  look  further  at  modifications  based 
on  utility  and  uncertainty  considerations. 
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C    (K$) 
m 


-10  •  10~ 


-20  •  10 


m(K$) 


-30  •  10' 


3 


-40  •  10 


3 


h  -  h  =  .0066 


FIGURE  6.   MARGINAL  COST  VERSUS  COST  OF  MONITORING 


IV.   UNCERTAINTY  CONSIDERATIONS 

In  this  chapter  we  will  consider  in  a  qualitative  way 
those  activities  of  reliability  improvement  which  were  not  a  factor 
in  any  of  the  previous  calculations.   As  indicated  in  Section  ID 
the  dividing  line  between  risk  based  on  objective  probabilities 
and  uncertainty  evaluated  by  subjective  judgment  and  probabilities 
is  not  clearcut.   A  descriptive  activity  might  be  categorized 
one  way  or  the  other,  dependent  on  how  much  back-up  data  is 
available. 

As  one  group  of  activities  let  us  consider  the  reliability 

improvement  processes  we  had  numbered  (lc),  (2c),  and  (4b); 

namely, 

(lc)  Functional  Design  -  Improvement  of  insensitivity  to 
parameter  changes 

(2c)   Packaging  -  Environmental  stress  protection 

(4b)   Operational  Procedures  -  Mitigation  of  stress  factors 

These  three  activities,  most  particularly  the  last  two,  involve 
what  stress  factor,  k,  is  to  be  assigned  to  the  various  phases  of 
the  FTS .   The  value  of  k  in  any  event  is  one  of  the  least  well 
known  factors  in  our  calculations  because  the  statistical  accuracy 
of  much  of  the  data  is  based  on  experiments  on  components  under 
standard  conditions.   How  this  data  will  apply  to  conditions  on 
a  yet-to-be-built  weapon  system  is  highly  subjective.   The 
insensitivity  to  parameter  changes  is  more  directly  related  to 
the  question  of  tolerance  failures  versus  catastrophic  failures. 

5  7 
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Again  the  piece  part  data  is  more  clearly  applied  in  the  area  of 
catastrophic  failures  of  parts  because  the  characteristics  of 
the  design  of  each  device  will  determine  whether  a  given  change 
of  parameters  in  a  part  will  actually  cause  a  failure  of  the 
device  due  to  tolerance  limits  being  exceeded.   Another  factor 
complicating  calculation  is  the  consideration  of  an  environment 
caused  by  enemy  countermeasures  in  which  a  device  may  have  to 
operate.   For  example,  the  radiation  environment  from  enemy 
defensive  nuclear  weapons  will  change  the  tolerance  levels  which 
determine  whether  an  electronic  device  will  still  operate  properly 
or  not.   Determination  of  this  level  is  difficult  enough  in  a 
benign  environment.   If  one  tries  to  design  to  be  fairly  immune 
to  tolerance  failures  in  a  specific  radiation  environment  (high 
environmental  levels  because  that  seems  to  be  a  "conservative" 
approach),  but  one  which  is  deemed  unlikely  to  be  encountered, 
the  result  appears  to  be  a  cost  for  the  activity  with  little 
calculable  gain  in  reliability. 

If  these  are  not  clearly  areas  of  uncertainty,  then  they 
at  least  seem  to  be  activities  in  which  the  risks  can  be  slanted, 
dependent  on  a  particular  evaluation  of  failure  probabilities. 
Slanting  is  used  in  the  manner  of  Fellner  in   12   where  the 
mathematical  expectation  of  values  is  consistently  adjusted  to 
influence  the  quantity  of  product  in  one  way  or  the  other.   Consider 
Figure  7.   As  indicated  before  in  our  calculation  of  an  initial 
reliability  goal  using  a  constant  value  of  product,  P,  the  inter- 
section of  P  with  marginal  cost  (MC)  gives  a  reliability  level  to 
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Cost 


Price 


Utility 


Reliability 


FIGURE  7.   LEVELS  OF  OUTPUT 


60 


the  left  of  the  intersection  with  average  cost  (AC) .   Now  if  one 

maximized  utility  where  the  marginal  utility  of  product  was 

diminishing,  the  indicated  level  of  reliability  would  be  further  to 

the  left  as  illustrated  by  a  marginal  utility  surplus  (MUS)  curve 

crossing  the  abscissa.   This  would  be  the  same  as  saying  that  P 

decreased  with  reliability  in  the  manner  of  curve  P'  to  intersect 

the  MC  curve  as  shown.   This  is  analogous  to  our  previous  contention 

that  the  assumption  of  constant  price  of  product  puts  an  upper 

bound  on  the  reliability  goal  which  one  should  set.   Of  course,  it 

could  happen  that  a  decision  maker  assumed  constant  price  and  found 

the  intersection  with  average  cost,  but  slanted  all  his  expectations 

in  such  a  manner  to  select  the  reliability  level  indicated  by 

correct  use  of  MUS.   But  that  would  be  happenstance,  and  he  might 

slant  to  make  matters  worse. 

Next  consider  activities  (Id),  (2b),  and  (4a): 

(Id)  Functional  Design  -  Provisions  for  test  in  field 

(2b)  Packaging  -  Accessibility  for  test  and  repair/replace 
in  field 

(4a)  Operational  Procedures  -  Test  and  repair/replace  cycle 

These  three  activities  are  all  closely  interdependent  and  related 
to  dormant  failure  rates  or  failures  induced  by  the  testing  itself. 
In  functional  design,  the  circuits  must  be  provided  so  that 
information  can  be  gained  by  monitoring  as  to  whether  the  equipment 
is  good  or  bad.   The  surest  way  is  to  essentially  cause  the 
equipment  to  operate,  but  this  would  usually  involve  a  severe 
design  penalty  to  preclude  significant  degradation  from  the  test 
itself.   A  visual  test  would  not  degrade  the  device  but  neither 
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would  it  give  much  information.   Thus,  the  test  procedure  selected 
will  not  give  perfect  information,  and  there  will  likely  be  some 
degradation  from  the  test  itself.   Also  one  must  have  a  general 
idea  as  to  how  many  monitoring  operations  will  be  conducted  in 
the  service  life  of  the  weapon  in  order  to  select  compatible 
components.   The  manner  of  packaging  the  functional  device  within 
the  weapon  affects  the  same  factors  and  together  the  two  activities 
largely  determine  what  the  "a"  factor  for  a  monitoring  operation 
will  be.   The  operational  procedures  would  seem  more  amenable 
to  change,  such  as  deciding  on  tests  during  the  service  life  when 
the  original  plan  had  been  to  treat  the  weapon  as  a  wooden  bomb. 
But  changing  operational  procedures  in  mid-life  for  a  complex 
logistics  system  may  entail  very  real  and  large  costs. 

The  aspect  of  uncertainty  seems  most  important  in  the  plans 
for  testing.   In  general,  if  one  believes  the  prediction  of  constant, 
low  dormant  failure  rate  X  ,  checkout  testing  would  not  make  sense 
until  considerable  time  had  elapsed  since  production  because  it 
would  give  little  payoff.   Essentially,  the  payoff  is  low  because 
reliability  for  the  lot  can  only  be  improved  when  bad  devices  are 
found  and  corrected.   For  Poisson  failures,  a  test  "good"  does 
nothing  to  improve  probability  that  the  device  will  be  good  at 
some  time  later.    And  few  failures  will  have  developed  in  a  short 
time  (hazard  product,  X  t  ,  is  low).   If  there  were  significant 


This  is  called  the  property  of  "memorylessness" .   For 
failures  which  occur  in  a  truly  random  fashion,  a  test  "good" 
does  not  change  the  probability  of  a  failure  occurring  in  the  next 
time  period. 
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degradation  from  testing,  the  result  of  a  monitoring  operation 
too  soon  (small  t.. )  would  be  degradation  of  reliability.   The 
only  valid  reason  for  very  frequent  monitoring  operations  then 
would  seem  to  be  based  on  the  likelihood  of  the  stress  factor  in 
the  intervening  phases  of  the  FTS  becoming  large  for  some  reason. 
If  this  did  happen,  it  would  probably  be  due  to  a  poor  development 
and  qualification  program  for  the  equipment.   Hopefully,  stress 
factors  significantly  above  unity  should  only  pertain  for  the  flight 
phase  of  an  REB  FTS. 

Suppose  one  decides  on  a  wooden  bomb  philosophy  in  an  REB 
development  program  based  on  a  fairly  low  predicted  dormant 
failure  rate  and  adopts  a  design  which  allows  for  no  provisions  for 
test  of  the  AFD  in  the  field  not  for  access  to  the  AFD  for  repair 
or  replacement.   Should  information  from  the  stockpile  sampling  or 
operational  test  programs  indicate  a  wholly  unexpected  reliability 
degradation  has  occurred,  the  corrective  action  would  then  involve 
essentially  replacement  of  the  entire  REB.   Let  us  simplify  this 
situation  by  saying  that  if  things  go  as  expected,  the  ex  ante 
average  reliability, 

R  =  96%  will  pertain. 


Recall  that  failure  rate  during  any  phase  of  index  i 

X.  =  k.u. 
1    li 

where  k.  is  the  stress  factor  and  u.  is  the  basic  failure  rate 
under  conditions  defined  as  standard.   The  k.'s  during  missile 
flight  phases  are  very  large  compared  to  all  other  phases  which 
are  usually  considered  unity  so  that  only  the  basic  failure  rate 
applies  during  non-flight  phases.   Events  such  as  rough  handling 
or  testing  may  induce  failures  at  a  rate  larger  than  the  basic 
failure  rate  unless  the  equipment  is  rugged  enough  to  withstand  all 
these  non-flight  environments.   The  occurrence  of  such  induced 
failures  is  equivalent  to  increase  of  the  stress  factor  during  that 
phase . 
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With  some  unexpected  failure,  and  correction  being  very  difficult 
to  effect,  the  resultant  ex  post  average  might  be  40%.   Then 
consider  that  the  utility  for  reliability  is  the  shape  shown  in 
Figure  8.   The  shape  is  derived  from  the  following  considerations. 
From  some  level  of  significant  damage  capability  marginal  utility 
increases  rapidly  until  above  some  higher  level  -  before  we  get 
into  our  regime  of  reliability  improvement  effort  -  marginal 
utility  will  decrease.   The  shape  of  the  curve  at  very  low  levels 
is  not  relevant  here.   If  one  assigned  subjective  probabilities 
to  the  likelihood  of  average  reliability  being  the  predicted  96% 
or  the  unpredicted  almost  complete  failure  of  a  component  to 
occur,  based  on  experience  with  programs  of  similar  complexity, 
the  judgment  might  be : 

p  =  5%  that  R  =  40% 
1  -  p  =  95%  that  R  =  96%. 

Then  in  a  manner  analogous  to  an  insurance/betting  utility  analysis, 
treating  reliability  units  as  money,  the  internal  average, 

p  •  (40%)  +  (1  -  p)  •  (95%)  =  93.2%, 

represents  the  certainty  equivalent  of  this  program.   But  the 
utility  shape  is  for  one  who  prefers  insurance,  and  the  construction 
in  Figure  8  shows  one  would  be  willing  to  pay  an  insurance  premium, 
the  difference  between  93.2%  and  76%,  to  hedge  against  the 
catastrophic  40%  result.   Converting  all  calculations  into  monetary 
terms,  it  seems  likely  under  fairly  wide  ranges  on  these  judgmental 
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FIGURE  8.   UTILITY  OF  RELIABILITY 


65 


values  that  one  could  make  provisions  for  field  test  and  repair 

at  a  cost  which  would  not  use  up  all  the  allowance  for  insurance 

1 
premium. 


Another  way  of  hedging  against  the  unpredicted  failure  mode 
is  to  use  a  redundant  channel,  utilizing  different  components 
and  operating  on  a  different  physical  principle.   This  reduces 
the  likelihood  of  catastrophic  reduction  of  reliability  from 
unpredicted  failures  in  a  major  way,  but  it  does  not  eliminate 
the  possibility. 


V.   ANSWERS  TO  QUESTIONS 

If  one  had  conducted  an  analysis  along  the  lines  indicated, 
could  the  questions  raised  in  Section  IA  now  be  answered?   It  is 
apparent  that  there  can  be  no  answers  which  hold  universally. 
Every  weapon  system  must  be  studied  on  its  own  merits  in  much 
detail.   Thus,  we  should  avoid  institutional  arrangements  that 
dictate  test  and  maintenance  philosophy  before  all  the  facts  are 
known  or  lead  to  reliability  specifications  which  are  difficult 
to  change  for  over-all  benefit  as  the  program  progresses.   Based 
on  the  REB  example  considered  herein,  we  can  make  some  general 
assertions  concerning  the  questions  if  we  stipulate  enough 
conditions  on  each  conclusion. 

(1)   There  are  certainly  powerful  inducements  for  decreeing 
that  a  wooden  bomb  be  produced.   Estimation  of  the  present  value 
of  the  cost  of  an  involved  test  and  maintenance  activity  over 
the  service  life  of  the  weapon  system  will  probably  show  up  as 
a  large  sum  whose  avoidance  looks  very  attractive.   And  the 
chance  that  any  reliability  payoff  might  be  negative  regardless 
of  monetary  cost  if  the  wrong  design  alternatives  or  test  procedures 
are  selected  is  a  discouraging  outlook.   The  decision  should 
depend  on  setting  the  marginal  utility  of  average  reliability 
equal  to  the  marginal  cost  of  obtaining  it.   If  an  agency  finds 
the  wooden  bomb  best  on  one  program,  it  should  not  necessarily 
decree  it  as  policy  on  all  other  programs.   On  the  other  hand, 
neither  should  an  agency  decree  maintenance  activities  because 


66 


67 


of  arbitrary  policy.   This  latter  possibility  is  seen  to  be 
likely  where  program  responsibility  is  split  between  semi -autonomous 
development  and  logistics  commands.   The  logistics  command  tends 
to  plan  extensive  maintenance  activities  for  some  reliability 
improvement  without  a  clear  picture  of  the  over-all  cost-benefit 
situation.   The  agency  making  decisions  should  have  responsibilities 
which  span  the  entire  life  of  the  weapon  system. 

(2)   Chapter  III  herein  covered  the  analysis  concerning 
the  nature  and  frequency  of  tests.   The  alternatives  are  many 
and  complex,  but  external  constraints  of  the  system  may  in  actuality 
limit  the  choices  severely.   Tests  in  general  will  be  done  when 
the  REB  is  available  at  little  cost.   The  nature  of  the  tests 
should  be  dictated  by  the  attempt  to  insure  a  correct  answer  to 
the  question  of  good  or  bad.   But  this  is  a  tradeoff  with  limiting 
degradation  from  the  test  procedure.   From  the  monitoring  operations 
there  is  the  byproduct  of  some  information  leading  to  forecast 
of  the  approach  of  the  wearout  period.   This  should  probably  not 
be  a  significant  factor  in  deciding  the  frequency  of  these  system 
tests.   This  statement  is  made  on  the  assumption  that  it  takes 
a  much  more  thorough   intensive  (probably  destructive)  examination 
to  detect  impending  wearout  conditions  than  would  be  efficient 
for  a  monitoring  operation  which  had  the  purpose  of  detecting 
failures  which  have  already  occurred.   The  stockpile  sampling 
program  as  a  separate  activity  could  more  efficiently  predict  the 
approach  of  wearout. 
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(3)  The  values  postulated  in  our  analysis  would  say  that 
one  should  hedge  against  unexpected  failure  modes  in  conjunction 
with  the  wooden  bomb  concept  and  pay  the  cost  for  a  removable 
functional  device.   This  would  not  necessarily  be  true  for  a 
lower  cost  weapon  or  one  where  the  logistic  cost  of  replacement 
of  the  entire  weapon  were  smaller. 

(4)  This  thesis  indicates  several  considerations  for 
lowering  a  reliability  goal  previously  set  without  proper  considera- 
tion of  all  economic  factors.   Neglect  of  economic  analysis  seems 
to  suggest  likelihood  of  the  reliability  goal  being  set  too  high. 
The  many  unknown  factors  and  iterative  calculations  called  for 
make  proper  decision  seem  very  difficult,  but  in  actuality  there 
may  be  only  a  fairly  small  number  of  practical  alternatives  from 
which  to  choose.   Again,  a  development  agency  with  over-all 
program  responsibility  is  suggested  as  a  desirable  institutional 
arrangement  because  of  the  necessity  for  authority  to  change 
reliability  goals  without  undue  administrative  delay  as  new 
information  becomes  available. 

(5)  The  last  question,  whether  to  develop  a  functional 
device  based  on  a  different  physical  principle,  is  really  not 
different  from  consideration  of  other  design  alternatives  except 
for  the  higher  uncertainty  attendant  to  a  research  program.   For 
a  given  system  effectiveness,  the  present  value  of  the  cost  of 
the  two  programs  is  compared.   However,  the  use  of  arbitrary  rules 
rather  than  rational  economic  reasoning  could  dictate  the  wrong 
alternative.   For  example,  if  an  agency  had  decreed  the  wooden 
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bomb  concept  for  the  entire  service  life  in  conjunction  with  a 
strict  minimum  reliability  specification,  an  electronic  device 
might  be  ruled  out  on  technical  feasibility  grounds  even  though 
its  choice  might  be  a  better  alternative  if  a  few  maintenance 
cycles  were  allowed. 

In  summary,  we  have  indicated  in  simple  terms  a  rationale 
for  the  application  of  economic  analysis  to  a  very  complex  technical 
problem.   The  following  quotation  from  Joan  Robinson  seems 
appropriate : 

The  analysis  can  be  extended  to  any  degree  of  refine- 
ment, but  the  more  complicated  the  question  the  more 
cumbersome  the  analysis.   In  order  to  know  anything  it 
is  necessary  to  know  everything,  but  in  order  to  talk 
about  anything  it  is  necessary  to  neglect  a  great  deal.  [l7] 


APPENDIX  1 

GENERALIZED  LAGRANGE  MULTIPLIER  METHOD 
A.   Background 

The  method  suggested  in  Chapter  II  for  solving  the  problem 
of  optimum  allocation  of  reliability  improvement  activities  is 
a  simple  application  of  the  Generalized  Lagrange  Multiplier 
Method  explained  in  reference   13   .   The  basic  framework  of 
the  method  will  be  outlined  in  this  appendix  in  terms  of  the 
problem  in  this  thesis. 

The  data  for  this  problem  would  not  normally  be  in  the  form 
of  dif f erentiable  functions  but  a  set  of  cost  estimates  corresponding 
to  several  discrete  intensity  levels  of  each  activity.   This  use 
of  Lagrange  multipliers  constitutes  a  technique  whose  goal  is 
maximization  of  the  total  reliability  improvement  subject  to 
a  cost  constraint.   The  domain  of  the  function  to  be  maximized 
is  the  set  of  reliability  improvements  possible,  choosing  one 
intensity  level  from  each  improvement  activity. 

B.   Formulation 

In  our  problem  we  have  set  up  four  different  activities  of 
index,  i  =  1  to  4.   For  each  we  can  select  an  intensity  level 
which  would  by  itself  result  in  a  reliability  improvement  of 

X.  =  1,  2,  or  3%.   The  set  of  possible  strategies  consists  of 

i 

all  possible  combinations  of  these  activity  levels.   The  over-all 
reliability  improvement,  X,  from  any  strategy  is  called  the  payoff 
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function.   Corresponding  to  the  intensity  level  of  each  activity 
there  is  a  cost,  C,  which  pertains  if  that  activity  were  the 
only  one  employed.   The  total  cost,  C,  of  any  strategy  is  called 
the  resource  function.   The  problem  to  be  solved  is  maximization 
of  the  payoff  subject  to  a  constraint  on  the  resource. 

As  a  subclass  of  the  general  problem,  our  problem  is  called 
a  cell  or  separable  problem  in  that  the  activities  are  considered 
to  be  independent  of  each  other  (over  the  small  range  of  variables 
in  question)  such  that  the  over-all  payoff  is  the  sum  of  the 
individual  payoffs,  and  the  over-all  cost  is  the  sum  of  the 
individual  costs.   The  problem  to  be  solved  in  this  case  is  to 
find  a  strategy,  one  intensity  level  from  each  activity,  which 
maximizes  the  reliability  improvement  subject  to  a  constraint 
on  cost : 


Maximize:    X  =  /]x  . 
Subject  to:  V*C .  =  C. 


C.   Main  Theorem 

The  main  theorem  of  reference  13   in  our  terminology  and 
for  only  one  constraint  is  as  follows:   Given  that 

(1)  All  Lagrange  multipliers,  m  ,  are  nonnegative 
real  numbers 

(2)  Strategy  S*  maximizes  the  unconstrained  function 
X  -  mC: 
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then  it  follows  that  S*  maximizes  X  over  all  strategies  such 
that  C  <  C(S") . 

This  theorem  says  that  for  any  choice  of  nonnegative  m,  if 
a  maximum  of  the  unconstrained  Lagrangean  function 

X  -mC 

can  be  found,  then  the  solution  is  a  solution  to  the  constrained 
maximization  problem  where  the  constraint  is  the  cost  expended 
in  achieving  the  unconstrained  solution.   According  to  the  theorem, 
one  can  simply  choose  an  arbitrary  set  of  nonnegative  mts,  find 
an  unconstrained  maximum  of  the  modified  payoff  function,  X  -mC, 
and  one  has  as  a  result  a  solution  to  a  constrained  problem. 
Different  choices  of  mts  lead  to  different  cost  levels.   The 
method  does  not  guarantee  that  an  answer  can  be  found,  but  asserts 
that  if  an  answer  can  be  found  it  will  indeed  be  optimum. 

In  applying  the  main  theorem  to  the  cell  problem  it  is  shown 
that  maximizing 

X.   -mC. 

i      i 

for  each  activity  independently  of  strategy  choices  in  other 
activities,  and  summing  the  payoffs  aid  costs  for  each  activity 
(for  the  strategy  that  maximized  the  Lagrangean  for  that  activity)  ; 
results  in  maximizing  £  X .  with  cost  constraint  equal  to  X!Cj_> 
both  summations  over  the  strategy  produced  by  the  procedure. 
The  theorem  says  nothing  about  the  manner  in  which  one 
obtains  the  maxima  of  the  unconstrained  Lagrangean  functions. 
In  our  case  where  we  do  not  have  analytic  functions  it  cannot 
be  done  by  finding  zeroes  of  derivatives.   It  is  done  in  this 
simple  example  by  listing  all  discrete  possibilities  and  picking 
the  maximum  result . 


APPENDIX   2 
ACTIVITIES  FOR  IMPROVEMENT  OF  INITIAL  RELIABILITY 

From  the  categorization  in  Section  ID  of  all  processes  for 
reliability  improvement,  four  activities  are  chosen  as  particularly 
applicable  to  initial  (when  new)  reliability.   The  four  are 
discussed  below  as  applied  to  the  case  of  an  electronic  arming 
and  fuzing  device  (AFD)  in  the  re-entry  body  (REB)  of  a  strategic 
missile . 

(1)   Reduction  of  AFD  Complexity 

The  AFD  was  made  complex  to  provide  a  level  of  accuracy  in 

sensing  height  of  burst  (HOB)  above  target.   The  very  nature 

of  electronic  device  failure  rate  versus  complexity  then  dictates 

a  lower  reliability  than  a  less  complex  device.   The  HOB  accuracy 

contributes  to  determination  of  a  radius  of  effect  (Rp)  for 

warhead  explosive  yield  to  kill  a  target  of  given  hardness. 

Accuracy  in  terms  of  the  circular  error  probable  (CEP)  of  the 

burst  is  also  affected  because  of  the  interaction  between  HOB 

dispersion  and  the  re-entry  trajectory.   R^  and  CEP  together 

determine  the  probability  of  kill  (P  )  for  a  single  target 

-|2X 


J 


RE/CEP 


.  Thus  the  functional  relations  exist  for 


=  1 

calculating  opportunity  costs  due  to  decreased  PK  from  lov ering 
complexity  if  we  assign  a  worth  to  the  REB  and  also  decide  on  how 
this  value  is  divvied  up  among  the  units  of  PR  of  the  basic  design. 
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Sophisticated  methods  looking  at  effectiveness  over  a  complete 
target  complex  may  be  dictated.   In  lowering  complexity  there  will 
be  an  offsetting  saving  (to  the  opportunity  costs)  in  pecuniary 
costs  of  development  and  production,  but  they  may  not  be  too 
significant  in  comparison.   (It  should  be  noted  that  increased 
complexity  can  result  in  higher  reliability  if  the  complexity 
is  required  to  overcome  an  enemy  countermeasure  environment.   We 
are  assuming  that  increased  complexity  is  only  for  the  purpose  of 
improving  performance  -  better  accuracy,  given  no  failure.) 

(2)   Redundancy 

The  design  options  under  this  activity  involve  putting  entire 
functional  channels  in  parallel  with  the  basic  series  functional 
circuit  or  selected  components  or  groups  of  components  in  parallel 
with  others.   Components  with  suspected  high  fallibility  would  of 
course  be  selected  for  redundancy.   The  entire  channel  redundancy 
is  normally  a  choice  between  single  or  dual  because  the  marginal 
return  in  reliability  rapidly  becomes  very  small  and  may  even  go 
negative  due  to  cross-channel  failure  paths.   We  are  assuming 
here  the  channel  or  component  is  duplicated  with  another  identical 
one.   Consideration  of  using  a  different  type  functional  circuit 
as  a  redundant  one  involves  hedging  against  uncertainty  in  predicting 
reliability  and  will  be  discussed  in  Chapter  IV.   The  major  costs 
of  this  activity  are  likely  to  be  the  opportunity  costs  represented 
by  the  weight  and  space  allocation  robbed  from  the  warhead  which 


would  result  in  lower  explosive  yield.   Since  Rp  is  roughly 
proportional  to  W    where  W  =  yield  of  warhead,  the 
opportunity  cost  can  be  calculated  as  done  for  activity  #1.   The 
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pecuniary  costs  in  this  case  would  be  additive  rather  than  off- 
setting but  probably  not  too  significant.   (Another  possible 
cost  is  in  the  area  of  nuclear  safety,  the  provision  of  low 
probability  of  an  unwanted  detonation,  and  should  be  mentioned. 
It  is  sometimes  assumed  that  increased  reliability  means  reduced 
safety  because  a  series  of  functional  safety  devices  would  indeed 
imply  reduced  reliability  compared  to  their  simple  removal.   However, 
much  can  be  done  in  the  way  of  devices  which  serve  both  operating 
and  safety  functions,  and  it  is  by  no  means  clear  that  a  prolifera- 
tion of  series  elements  will  insure  maximum  safety.   In  any  event 
an  almost  absolute  safety  criterion  is  enforced  for  any  design 
option.   Any  differences  in  probability  of  unwanted  detonation 
between  different  designs  are  essentially  not  calculable  -  the 
differences  between  very  small  numbers.   The  cost  of  an  unwanted 
nuclear  detonation  is  unknown  except  to  say  it  is  unacceptably 
high.   Significant  costs  for  providing  safety  are  difficult  to 
separate  from  the  other  costs  of  development.   For  these  reasons 
an  estimate  of  costs  involving  safety  will  not  be  included.) 

(3)   Provision  for  Integrated  Test  in  Manufacture 
From  the  standpoint  of  efficiency  in  packaging  the  functional 
parts  in  the  REB  -  where  efficiency  means  allowing  more  weight 
and  space  allocation  for  the  warhead  and  more  freedom  of  design 
for  the  REB  structure  -  it  is  generally  better  to  split  up  the  AFD 
and  tuck  it  here  and  there  to  best  utilize  the  available  locations. 
But  this  splitting  up  means  addition  of  cable  runs  with  inherent 
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fault  potentials  and  a  very  much  more  difficult  job  of  testing  the 
AFD  during  development,  evaluation,  and  qualification  programs 
in  its  operational  configuration.   Thus  to  gain  reliability  in 
a  design  which  is  not  single  unit,  we  can  choose  designs  which 
come  closer  to  being  single  unit.   As  in  activity  #2  the  robbing 
of  space  and  weight  allocation  will  result  in  lower  yield.   The 
effect  might  even  be  severe  enough  to  decrease  accuracy  due  to 
limitations  on  REB  structure  design  options  which  would  influence 
aerodynamic  characteristics  during  re-entry.   In  any  event  the 
opportunity  costs  due  to  reduced  P  can  be  calculated.   One  would 
expect  some  offsetting  savings  in  the  test  programs.   Experience 
on  earlier  designs  should  enable  engineers  to  make  reasonable 
estimates  of  the  AR  to  be  gained  from  different  degrees  of  movement 
toward  a  single  unit  design. 

(4)   Manufacturing  and  Quality  Control 

This  activity  would  apply  to  a  design  resulting  from  any 
combination  of  intensity  levels  in  the  first  three  activities. 
It  would  consist  of  actions  such  as : 

(a)  Use  of  high  reliability  parts,  attained  by  careful 
design,  intensive  controls  during  manufacture,  extensive  testing 
for  statistical  confidence  in  the  design,  and  screening  manufactured 
parts  by  complete  testing  of  parameters. 

(b)  Intensive  process  controls  during  manufacture 
and  quality  control  tests  of  the  end  item. 
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The  costs  of  this  activity  are  the  pecuniary  costs  of  different 
intensity  levels.   Actually  the  cost  for  a  given  AR  would  be 
dependent  on  what  combination  of  the  first  three  activities  was 
embodied  in  the  design  and  program  changes  proposed.   On  the  other 
hand,  over  a  limited  range  of  design  and  program  changes,  considering 
the  C.  versus  X.  relationship  for  this  activity  as  independent  of 
the  other  activities  might  not  be  a  bad  approximation,  bearing 
in  mind  we  are  looking  at  limited  changes  to  a  basic  program  which 
already  includes  a  considerable  amount  of  this  kind  of  activity. 
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